T09 · Insecure Skill Coding Practices
Error
- Location
main.py:62- Finding
HTML Injection and Cross-Site Scripting in Generated Documents
- Content
View full analysis
', text) # Links text = re.sub(r'\[([^\]]+)\]\(([^)]+)\)', r'\1', text) # Bold+italic text = re.sub(r'\*\*\*(.+?)\*\*\*', r'\1', text) # Bold text = re.sub(r'\*\*(.+?)\*\*', r'\1', text) # Italic text = re.sub(r'\*(.+?)\*', r'\1', text) # Inline code text = re.sub(r'`([^`]+)`', r'\1', text) # Strikethrough text = re.sub(r'~~(.+?)~~', r'\1', text) return text ``` The unescaped result is then used throughout the generated HTML: ```python # Headings m = re.match(r'^(#{1,6})\s+(.+)$', stripped) if m: close_para() close_list() level = len(m.group(1)) html_lines.append(f'{inline(m.group(2))}') continue ``` ```python # Blockquote if stripped.startswith('>'): close_para() close_list() text = stripped.lstrip('>').strip() html_lines.append(f'
') continue ``` ```python # Unordered list m = re.match(r'^[-*+]\s+(.+)$', stripped) if m: close_para() if in_list != 'ul': close_list() html_lines.append('{inline(text)}
- ')
in_list = 'ul'
html_lines.append(f'
- {inline(m.group(1))} ') continue # Ordered list m = re.match(r'^\d+\.\s+(.+)$', stripped) if m: close_para() if in_list != 'ol': close_list() ...[truncated 3549 chars]
- Remediation
View remediation
` elements, event handlers, quote-breaking attributes, `javascript:` links, `data:` URLs, mixed-case schemes, encoded control characters, and malicious image sources cannot produce executable HTML. A safe design should follow this sequence: ```text Parse Markdown into tokens → validate URL schemes → escape all token text and attribute values contextually → generate only allowlisted HTML elements and attributes → sanitize the final output as defense in depth ``` ]]>