Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-28 20:38:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🎨 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-23 11:03:39 +08:00
parent b804cd2d61
commit e492b1fa51
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
9 changed files with 20 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kernel/model/import.go
View file

@ -583,7 +583,7 @@ func ImportSY(zipPath, boxID, toPath string) (err error) {
}
if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := path
fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadFileName(d.Name()))
fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadEmojiFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
@ -732,7 +732,7 @@ func ImportData(zipPath string) (err error) {
}
if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := path
fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadFileName(d.Name()))
fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadEmojiFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {