🎨 Fix XSS in the tag name https://github.com/siyuan-note/siyuan/issues/13168

kernel/sql/asset.go

@@ -21,9 +21,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/siyuan-note/filelock"
-
 	"github.com/88250/lute/ast"
+	"github.com/siyuan-note/filelock"
 	"github.com/siyuan-note/logging"
 	"github.com/siyuan-note/siyuan/kernel/treenode"
 	"github.com/siyuan-note/siyuan/kernel/util"
@@ -45,14 +44,15 @@ func docTagSpans(n *ast.Node) (ret []*Span) {
 	if tagsVal := n.IALAttr("tags"); "" != tagsVal {
 		tags := strings.Split(tagsVal, ",")
 		for _, tag := range tags {
-			markdown := "#" + tag + "#"
+			escaped := util.EscapeHTML(tag)
+			markdown := "#" + escaped + "#"
 			span := &Span{
 				ID:       ast.NewNodeID(),
 				BlockID:  n.ID,
 				RootID:   n.ID,
 				Box:      n.Box,
 				Path:     n.Path,
-				Content:  tag,
+				Content:  escaped,
 				Markdown: markdown,
 				Type:     "tag",
 				IAL:      "",