SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

QFinch assessment

POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block's full attribute set (IAL) with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader supplying a block ID receives the block's name, alias, memo, bookmark, tags, and every custom- attribute including for blocks in publish-forbidden and password-protected documents. The batch variant accepts an ID list, making it a bulk extraction primitive.

Potential impact

An anonymous reader (publish mode with auth disabled) or any publish RoleReader can read block attributes belonging to publish-forbidden and password-protected documents, including user-authored memos and arbitrary custom- values. The batch endpoint turns this into a bulk primitive: given a set of block IDs, an attacker retrieves attributes across the whole workspace in a single request. Confidentiality-only.

Technical context

Neither handler applies a filter: sql.GetBlockAttrs is a direct database read returning the block's entire IAL: name, alias, memo, bookmark, tags, and any custom- key/value the user has set. Several of these are user-authored free text memos in particular are freeform notes attached to a block so this is document content, not merely structural metadata. batchGetBlockAttrs takes an arbitrary list of block IDs in a single request, so an attacker holding a set of block IDs can sweep attributes across the entire workspace in one call. Guarded-sibling asymmetry. The sibling metadata endpoint getBlockInfo calls checkBlockPublishAccess(c, id, ret) before returning; getBlockAttrs and batchGetBlockAttrs call nothing. Verified at origin/master: both handler bodies contain no publish-access, publish-ignore, or readonly-role check, and both routes are registered CheckAuth without CheckAdminRole.