Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-19 16:10:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-15 17:06:43 +08:00
parent a9ae243baf
commit db18639080
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kernel/api/system.go
View file

@ -165,7 +165,7 @@ func getEmojiConf(c *gin.Context) {
} else { } else {
for _, customEmoji := range customEmojis { for _, customEmoji := range customEmojis {
name := customEmoji.Name() name := customEmoji.Name()
if strings.HasPrefix(name, ".") || strings.Contains(name, "<") { if strings.HasPrefix(name, ".") || strings.ContainsAny(name, "<\"") {
continue continue
} }
@ -183,7 +183,7 @@ func getEmojiConf(c *gin.Context) {
} }
name = subCustomEmoji.Name() name = subCustomEmoji.Name()
if strings.HasPrefix(name, ".") || strings.Contains(name, "<") { if strings.HasPrefix(name, ".") || strings.ContainsAny(name, "<\"") {
continue continue
} }