Skip to content

Commit 6073980

Browse files
committed
fix: potential XSS vulnerabilities
1 parent b9f397d commit 6073980

File tree

3 files changed

+75
-0
lines changed

3 files changed

+75
-0
lines changed

go.mod

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ require (
8282

8383
require (
8484
github.com/STARRY-S/zip v0.2.1 // indirect
85+
github.com/aymerick/douceur v0.2.0 // indirect
8586
github.com/blevesearch/go-faiss v1.0.20 // indirect
8687
github.com/blevesearch/zapx/v16 v16.1.5 // indirect
8788
github.com/bodgit/plumbing v1.3.0 // indirect
@@ -95,18 +96,21 @@ require (
9596
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
9697
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
9798
github.com/fclairamb/go-log v0.5.0 // indirect
99+
github.com/gorilla/css v1.0.1 // indirect
98100
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
99101
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
100102
github.com/hekmon/cunits/v2 v2.1.0 // indirect
101103
github.com/ipfs/boxo v0.12.0 // indirect
102104
github.com/jackc/puddle/v2 v2.2.1 // indirect
103105
github.com/klauspost/pgzip v1.2.6 // indirect
104106
github.com/kr/text v0.2.0 // indirect
107+
github.com/microcosm-cc/bluemonday v1.0.27
105108
github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
106109
github.com/sorairolake/lzip-go v0.3.5 // indirect
107110
github.com/taruti/bytepool v0.0.0-20160310082835-5e3a9ea56543 // indirect
108111
github.com/therootcompany/xz v1.0.1 // indirect
109112
github.com/ulikunitz/xz v0.5.12 // indirect
113+
github.com/yuin/goldmark v1.7.8
110114
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
111115
)
112116

go.sum

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
6666
github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
6767
github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
6868
github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
69+
github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
70+
github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
6971
github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=
7072
github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
7173
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -297,6 +299,8 @@ github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+
297299
github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
298300
github.com/googleapis/gax-go/v2 v2.12.2 h1:mhN09QQW1jEWeMF74zGR81R30z4VJzjZsfkUhuHF+DA=
299301
github.com/googleapis/gax-go/v2 v2.12.2/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc=
302+
github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
303+
github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
300304
github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
301305
github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
302306
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
@@ -418,6 +422,8 @@ github.com/meilisearch/meilisearch-go v0.27.2 h1:3G21dJ5i208shnLPDsIEZ0L0Geg/5oe
418422
github.com/meilisearch/meilisearch-go v0.27.2/go.mod h1:SxuSqDcPBIykjWz1PX+KzsYzArNLSCadQodWs8extS0=
419423
github.com/mholt/archives v0.1.0 h1:FacgJyrjiuyomTuNA92X5GyRBRZjE43Y/lrzKIlF35Q=
420424
github.com/mholt/archives v0.1.0/go.mod h1:j/Ire/jm42GN7h90F5kzj6hf6ZFzEH66de+hmjEKu+I=
425+
github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
426+
github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
421427
github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
422428
github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
423429
github.com/minio/sio v0.4.0 h1:u4SWVEm5lXSqU42ZWawV0D9I5AZ5YMmo2RXpEQ/kRhc=
@@ -607,6 +613,8 @@ github.com/yeka/zip v0.0.0-20231116150916-03d6312748a9/go.mod h1:9BnoKCcgJ/+SLhf
607613
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
608614
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
609615
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
616+
github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
617+
github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
610618
github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
611619
github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
612620
github.com/zzzhr1990/go-common-entity v0.0.0-20221216044934-fd1c571e3a22 h1:X+lHsNTlbatQ1cErXIbtyrh+3MTWxqQFS+sBP/wpFXo=

server/common/proxy.go

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,83 @@
11
package common
22

33
import (
4+
"bytes"
45
"context"
56
"fmt"
67
"io"
78
"net/http"
89
"net/url"
10+
"strconv"
911

1012
"github.com/alist-org/alist/v3/internal/model"
1113
"github.com/alist-org/alist/v3/internal/net"
1214
"github.com/alist-org/alist/v3/internal/stream"
1315
"github.com/alist-org/alist/v3/pkg/http_range"
1416
"github.com/alist-org/alist/v3/pkg/utils"
17+
"github.com/microcosm-cc/bluemonday"
1518
log "github.com/sirupsen/logrus"
19+
"github.com/yuin/goldmark"
1620
)
1721

22+
func processMarkdown(content []byte) ([]byte, error) {
23+
var buf bytes.Buffer
24+
if err := goldmark.New().Convert(content, &buf); err != nil {
25+
return nil, fmt.Errorf("markdown conversion failed: %w", err)
26+
}
27+
return bluemonday.UGCPolicy().SanitizeBytes(buf.Bytes()), nil
28+
}
29+
1830
func Proxy(w http.ResponseWriter, r *http.Request, link *model.Link, file model.Obj) error {
31+
32+
//优先处理md文件
33+
if utils.Ext(file.GetName()) == "md" {
34+
var markdownContent []byte
35+
var err error
36+
37+
if link.MFile != nil {
38+
defer link.MFile.Close()
39+
attachFileName(w, file)
40+
markdownContent, err = io.ReadAll(link.MFile)
41+
if err != nil {
42+
return fmt.Errorf("failed to read markdown content: %w", err)
43+
}
44+
45+
} else {
46+
header := net.ProcessHeader(r.Header, link.Header)
47+
res, err := net.RequestHttp(r.Context(), r.Method, header, link.URL)
48+
if err != nil {
49+
return err
50+
}
51+
defer res.Body.Close()
52+
for h, v := range res.Header {
53+
w.Header()[h] = v
54+
}
55+
w.WriteHeader(res.StatusCode)
56+
if r.Method == http.MethodHead {
57+
return nil
58+
}
59+
markdownContent, err = io.ReadAll(res.Body)
60+
if err != nil {
61+
return fmt.Errorf("failed to read markdown content: %w", err)
62+
}
63+
64+
}
65+
66+
safeHTML, err := processMarkdown(markdownContent)
67+
if err != nil {
68+
return err
69+
}
70+
71+
safeHTMLReader := bytes.NewReader(safeHTML)
72+
w.Header().Set("Content-Length", strconv.FormatInt(int64(len(safeHTML)), 10))
73+
w.Header().Set("Content-Type", "text/html; charset=utf-8")
74+
_, err = utils.CopyWithBuffer(w, safeHTMLReader)
75+
if err != nil {
76+
return err
77+
}
78+
return nil
79+
}
80+
1981
if link.MFile != nil {
2082
defer link.MFile.Close()
2183
attachFileName(w, file)
@@ -72,6 +134,7 @@ func Proxy(w http.ResponseWriter, r *http.Request, link *model.Link, file model.
72134
return nil
73135
}
74136
}
137+
75138
func attachFileName(w http.ResponseWriter, file model.Obj) {
76139
fileName := file.GetName()
77140
w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"; filename*=UTF-8''%s`, fileName, url.PathEscape(fileName)))

0 commit comments

Comments
 (0)