Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-16 22:50:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🎨 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-23 11:03:39 +08:00
parent b804cd2d61
commit e492b1fa51
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
9 changed files with 20 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

7
kernel/util/file.go
View file

@ -188,6 +188,13 @@ func IsValidUploadFileName(name string) bool {
return name == FilterUploadFileName(name)
}
func FilterUploadEmojiFileName(name string) string {
name = strings.ReplaceAll(name, "/", "_@slash@_")
name = FilterUploadFileName(name)
name = strings.ReplaceAll(name, "_@slash@_", "/")
return name
}
func FilterUploadFileName(name string) string {
ret := FilterFileName(name)