Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 07:00:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-16 22:32:36 +08:00
parent 724cddf7cb
commit e5a634d90c
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 16 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

23
kernel/api/system.go
View file

@ -28,6 +28,7 @@ import (
"github.com/88250/lute" "github.com/88250/lute"
"github.com/88250/lute/html" "github.com/88250/lute/html"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
"github.com/siyuan-note/filelock"
"github.com/siyuan-note/logging" "github.com/siyuan-note/logging"
"github.com/siyuan-note/siyuan/kernel/conf" "github.com/siyuan-note/siyuan/kernel/conf"
"github.com/siyuan-note/siyuan/kernel/model" "github.com/siyuan-note/siyuan/kernel/model"
@ -171,13 +172,12 @@ func getEmojiConf(c *gin.Context) {
} }
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := customConfDir + "/" + name emojiFullName := filepath.Join(customConfDir, name)
fullPathFilteredName := customConfDir + "/" + util.FilterUploadFileName(name) fullPathFilteredName := filepath.Join(customConfDir, util.FilterUploadFileName(name))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("invalid custom emoji name [%s]", name) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName)
logging.LogErrorf("renaming invalid file to [%s] in emojis", fullPathFilteredName) if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
if removeErr := os.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { logging.LogErrorf("renaming invalid custom emoji file to [%s] failed: %s", fullPathFilteredName, removeErr)
logging.LogErrorf("renaming invalid file to [%s] failed: %s", fullPathFilteredName, removeErr)
} }
} }
@ -200,13 +200,12 @@ func getEmojiConf(c *gin.Context) {
} }
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := customConfDir + "/" + name emojiFullName := filepath.Join(customConfDir, name)
fullPathFilteredName := customConfDir + "/" + util.FilterUploadFileName(name) fullPathFilteredName := filepath.Join(customConfDir, util.FilterUploadFileName(name))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("invalid custom emoji name [%s]", name) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName)
logging.LogErrorf("renaming invalid file to [%s] in emojis", fullPathFilteredName) if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
if removeErr := os.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { logging.LogErrorf("renaming invalid custom emoji file to [%s] failed: %s", fullPathFilteredName, removeErr)
logging.LogErrorf("renaming invalid file to [%s] failed: %s", fullPathFilteredName, removeErr)
} }
} }

11
kernel/model/import.go
View file

@ -559,13 +559,12 @@ func ImportSY(zipPath, boxID, toPath string) (err error) {
// 将包含的自定义表情统一移动到 data/emojis/ 下 // 将包含的自定义表情统一移动到 data/emojis/ 下
filelock.Walk(filepath.Join(unzipRootPath, "emojis"), func(path string, d fs.DirEntry, err error) error { filelock.Walk(filepath.Join(unzipRootPath, "emojis"), func(path string, d fs.DirEntry, err error) error {
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := unzipRootPath + "emojis/" + name emojiFullName := filepath.Join(unzipRootPath, "emojis", d.Name())
fullPathFilteredName := unzipRootPath + "emojis/" + util.FilterUploadFileName(name) fullPathFilteredName := filepath.Join(unzipRootPath, "emojis", util.FilterUploadFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("invalid custom emoji name [%s]", name) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
logging.LogErrorf("renaming invalid file to [%s] in emojis", fullPathFilteredName) if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
if removeErr := os.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { logging.LogErrorf("renaming invalid custom emoji file to [%s] failed: %s", fullPathFilteredName, removeErr)
logging.LogErrorf("renaming invalid file to [%s] failed: %s", fullPathFilteredName, removeErr)
} }
} }
return nil return nil