Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 07:00:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🎨 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-23 11:03:39 +08:00
parent b804cd2d61
commit e492b1fa51
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
9 changed files with 20 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
kernel/api/block.go
View file

@ -629,7 +629,7 @@ func getBlockInfo(c *gin.Context) {
icon := root.IAL["icon"] icon := root.IAL["icon"]
if strings.Contains(icon, ".") { if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
} }
ret.Data = map[string]string{ ret.Data = map[string]string{
"box": block.Box, "box": block.Box,

2
kernel/api/setting.go
View file

@ -657,7 +657,7 @@ func setEmoji(c *gin.Context) {
e := ae.(string) e := ae.(string)
if strings.Contains(e, ".") { if strings.Contains(e, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
e = util.FilterUploadFileName(e) e = util.FilterUploadEmojiFileName(e)
} }
emoji = append(emoji, e) emoji = append(emoji, e)
} }

4
kernel/api/system.go
View file

@ -173,7 +173,7 @@ func getEmojiConf(c *gin.Context) {
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := filepath.Join(customConfDir, name) emojiFullName := filepath.Join(customConfDir, name)
name = util.FilterUploadFileName(name) name = util.FilterUploadEmojiFileName(name)
fullPathFilteredName := filepath.Join(customConfDir, name) fullPathFilteredName := filepath.Join(customConfDir, name)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName)
@ -202,7 +202,7 @@ func getEmojiConf(c *gin.Context) {
if !util.IsValidUploadFileName(html.UnescapeString(subName)) { if !util.IsValidUploadFileName(html.UnescapeString(subName)) {
emojiFullName := filepath.Join(customConfDir, name, subName) emojiFullName := filepath.Join(customConfDir, name, subName)
fullPathFilteredName := filepath.Join(customConfDir, name, util.FilterUploadFileName(subName)) fullPathFilteredName := filepath.Join(customConfDir, name, util.FilterUploadEmojiFileName(subName))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", subName, fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", subName, fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {

4
kernel/model/blockinfo.go
View file

@ -68,7 +68,7 @@ func GetDocInfo(blockID string) (ret *BlockInfo) {
icon := ret.IAL["icon"] icon := ret.IAL["icon"]
if strings.Contains(icon, ".") { if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
ret.IAL["icon"] = icon ret.IAL["icon"] = icon
} }
@ -141,7 +141,7 @@ func GetDocInfo(blockID string) (ret *BlockInfo) {
icon = tree.Root.IALAttr("icon") icon = tree.Root.IALAttr("icon")
if strings.Contains(icon, ".") { if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
} }
ret.Icon = icon ret.Icon = icon
return return

6
kernel/model/box.go
View file

@ -130,7 +130,7 @@ func ListNotebooks() (ret []*Box, err error) {
icon := boxConf.Icon icon := boxConf.Icon
if strings.Contains(icon, ".") { // 说明是自定义图标 if strings.Contains(icon, ".") { // 说明是自定义图标
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
} }
box := &Box{ box := &Box{
@ -200,7 +200,7 @@ func (box *Box) GetConf() (ret *conf.BoxConf) {
icon := ret.Icon icon := ret.Icon
if strings.Contains(icon, ".") { if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
ret.Icon = icon ret.Icon = icon
} }
return return
@ -708,7 +708,7 @@ func ChangeBoxSort(boxIDs []string) {
func SetBoxIcon(boxID, icon string) { func SetBoxIcon(boxID, icon string) {
if strings.Contains(icon, ".") { if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
} }
box := &Box{ID: boxID} box := &Box{ID: boxID}

2
kernel/model/conf.go
View file

@ -234,7 +234,7 @@ func InitConf() {
for i, emoji := range Conf.Editor.Emoji { for i, emoji := range Conf.Editor.Emoji {
if strings.Contains(emoji, ".") { if strings.Contains(emoji, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
emoji = util.FilterUploadFileName(emoji) emoji = util.FilterUploadEmojiFileName(emoji)
Conf.Editor.Emoji[i] = emoji Conf.Editor.Emoji[i] = emoji
} }
} }

2
kernel/model/file.go
View file

@ -83,7 +83,7 @@ func (box *Box) docFromFileInfo(fileInfo *FileInfo, ial map[string]string) (ret
icon := ial["icon"] icon := ial["icon"]
if strings.Contains(icon, ".") { if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon) icon = util.FilterUploadEmojiFileName(icon)
} }
ret.Icon = icon ret.Icon = icon
ret.ID = ial["id"] ret.ID = ial["id"]

4
kernel/model/import.go
View file

@ -583,7 +583,7 @@ func ImportSY(zipPath, boxID, toPath string) (err error) {
} }
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := path emojiFullName := path
fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadFileName(d.Name())) fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadEmojiFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
@ -732,7 +732,7 @@ func ImportData(zipPath string) (err error) {
} }
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := path emojiFullName := path
fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadFileName(d.Name())) fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadEmojiFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {

7
kernel/util/file.go
View file

@ -188,6 +188,13 @@ func IsValidUploadFileName(name string) bool {
return name == FilterUploadFileName(name) return name == FilterUploadFileName(name)
} }
func FilterUploadEmojiFileName(name string) string {
name = strings.ReplaceAll(name, "/", "_@slash@_")
name = FilterUploadFileName(name)
name = strings.ReplaceAll(name, "_@slash@_", "/")
return name
}
func FilterUploadFileName(name string) string { func FilterUploadFileName(name string) string {
ret := FilterFileName(name) ret := FilterFileName(name)