GHSA-c8w8-3pqp-wr83 - SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

### Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's `url.Values.Get` returns only the first value for a repeated key, a single URI can satisfy the exemption and still resolve to a non-auth session identity. The result is that an unauthenticated remote caller connects to the kernel WebSocket with a valid access auth code configured, is placed in the general broadcast pool rather than the quarantined pool, and receives the live event stream. ### Details **The exemption matches substrings.** `kernel/server/serve.go:1222` on the development branch, `:1074` on master: ```go authOk = strings.Contains(s.Request.RequestURI, "/ws?app=siyuan") && strings.Contains(s.Request.RequestURI, "&id=auth&type=auth") ``` Neither operand is parsed. Any URI containing both literals is exempted, regardless of what the query actually resolves to. **The quarantine parses.** Commit `1e370e373` added the containment for exempted sessions at `kernel/util/websocket.go:171`: ```go id = session.Request.URL.Query().Get("id") return "auth" == id ``` `url.Values.Get` returns the first value for a repeated key. **The differential.** For the URI: ``` /ws?app=siyuan&id=main&type=main&id=auth&type=auth ``` - It contains `/ws?app=siyuan` and `&id=auth&type=auth`, so `authOk` is true. No cookie, no JWT and no access auth code are required. - `Query().Get("id")` returns `main`, so `IsAuthSession` is false. `AddPushChan` files the session in `sessions`, the broadcast pool, rather than in `authSessions`. - `Query().Get("type")` returns `main`, so the session matches `BroadcastByType("main", ...)`. - Without a valid `X-Auth-Token` the publish flag is never set, so `isPublishSession()` does not exclude it either. Every guard that should have caught the session keys off a different parse