Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-30 05:18:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🐛 Breadcrumb XSS https://github.com/siyuan-note/siyuan/issues/10753

Browse source
This commit is contained in:
Daniel 2024-03-28 16:59:50 +08:00
parent 42967694ef
commit da6ba86948
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
kernel/model/blockinfo.go
View file

@ -361,12 +361,11 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
fc = fc.Next
}
name := util.EscapeHTML(parent.IALAttr("name"))
name := parent.IALAttr("name")
if ast.NodeDocument == parent.Type {
name = util.EscapeHTML(box.Name) + util.EscapeHTML(hPath)
name = box.Name + hPath
} else if ast.NodeAttributeView == parent.Type {
name = treenode.GetAttributeViewName(parent.AttributeViewID)
name = util.EscapeHTML(name)
} else {
if "" == name {
if ast.NodeListItem == parent.Type {
@ -374,7 +373,6 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
} else {
name = gulu.Str.SubStr(renderBlockText(parent, excludeTypes), maxNameLen)
}
name = util.EscapeHTML(name)
}
if ast.NodeHeading == parent.Type {
headingLevel = parent.HeadingLevel
@ -391,15 +389,15 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
if ast.NodeListItem == parent.Type {
if "" == name {
name = gulu.Str.SubStr(renderBlockText(fc, excludeTypes), maxNameLen)
name = util.EscapeHTML(name)
}
}
name = strings.ReplaceAll(name, editor.Caret, "")
name = util.EscapeHTML(name)
if add {
ret = append([]*BlockPath{{
ID: id,
Name: util.EscapeHTML(name),
Name: name,
Type: parent.Type.String(),
SubType: treenode.SubTypeAbbr(parent),
}}, ret...)
@ -418,9 +416,10 @@ func buildBlockBreadcrumb(node *ast.Node, excludeTypes []string) (ret []*BlockPa
if ast.NodeHeading == b.Type && headingLevel > b.HeadingLevel {
name = gulu.Str.SubStr(renderBlockText(b, excludeTypes), maxNameLen)
name = util.EscapeHTML(name)
ret = append([]*BlockPath{{
ID: b.ID,
Name: util.EscapeHTML(name),
Name: name,
Type: b.Type.String(),
SubType: treenode.SubTypeAbbr(b),
}}, ret...)