🔒 SQL injection security vulnerabilities #13077 #13059

siyuan-note · Nov 7, 2024 · 831d350 · 831d350
1 parent 7fa1f89
commit 831d350
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/kernel/model/asset_content.go b/kernel/model/asset_content.go
@@ -63,6 +63,9 @@ func GetAssetContent(id, query string, queryMethod int) (ret *AssetContent) {
 			query = stringQuery(query)
 		}
 	}
+	if !ast.IsNodeIDPattern(id) {
+		return
+	}
 
 	table := "asset_contents_fts_case_insensitive"
 	filter := " id = '" + id + "'"