SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

Summary

An unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint:

• GET /api/icon/getDynamicIcon

When type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin.

This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link.

Details

The issue is caused by unsafe output construction and incomplete sanitization:

1. Endpoint is exposed without auth middleware

   • Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/router.go#L27-L37
   • GET /api/icon/getDynamicIcon is registered in the unauthenticated section.

2. User input is inserted into SVG via string formatting

   • Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L115-L175
   • Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/api/icon.go#L537-L585
   • In generateTypeEightSVG, %s directly injects content into <text>...</text> without XML/HTML escaping.

3. Sanitizer only removes <script> tags

   • Source: https://github.com/siyuan-note/siyuan/blob/master/kernel/util/misc.go#L235-L281
   • RemoveScriptsInSVG removes <script> nodes, but does not remove dangerous attributes (onerror, onload, etc.) or unsafe elements.

As a result, payloads such as </text><image ... onerror=...><text> survive and execute.

PoC