Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-23 18:10:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🎨 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-23 11:03:39 +08:00
parent b804cd2d61
commit e492b1fa51
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
9 changed files with 20 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
kernel/model/box.go
View file

@ -130,7 +130,7 @@ func ListNotebooks() (ret []*Box, err error) {
icon := boxConf.Icon
if strings.Contains(icon, ".") { // 说明是自定义图标
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
icon = util.FilterUploadEmojiFileName(icon)
}
box := &Box{
@ -200,7 +200,7 @@ func (box *Box) GetConf() (ret *conf.BoxConf) {
icon := ret.Icon
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
icon = util.FilterUploadEmojiFileName(icon)
ret.Icon = icon
}
return
@ -708,7 +708,7 @@ func ChangeBoxSort(boxIDs []string) {
func SetBoxIcon(boxID, icon string) {
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
icon = util.FilterUploadEmojiFileName(icon)
}
box := &Box{ID: boxID}