Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-01-03 23:38:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🎨 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-23 11:03:39 +08:00
parent b804cd2d61
commit e492b1fa51
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
9 changed files with 20 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
kernel/api/block.go
View file

@ -629,7 +629,7 @@ func getBlockInfo(c *gin.Context) {
icon := root.IAL["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
icon = util.FilterUploadEmojiFileName(icon)
}
ret.Data = map[string]string{
"box": block.Box,

2
kernel/api/setting.go
View file

@ -657,7 +657,7 @@ func setEmoji(c *gin.Context) {
e := ae.(string)
if strings.Contains(e, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
e = util.FilterUploadFileName(e)
e = util.FilterUploadEmojiFileName(e)
}
emoji = append(emoji, e)
}

4
kernel/api/system.go
View file

@ -173,7 +173,7 @@ func getEmojiConf(c *gin.Context) {
if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := filepath.Join(customConfDir, name)
name = util.FilterUploadFileName(name)
name = util.FilterUploadEmojiFileName(name)
fullPathFilteredName := filepath.Join(customConfDir, name)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName)
@ -202,7 +202,7 @@ func getEmojiConf(c *gin.Context) {
if !util.IsValidUploadFileName(html.UnescapeString(subName)) {
emojiFullName := filepath.Join(customConfDir, name, subName)
fullPathFilteredName := filepath.Join(customConfDir, name, util.FilterUploadFileName(subName))
fullPathFilteredName := filepath.Join(customConfDir, name, util.FilterUploadEmojiFileName(subName))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", subName, fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {