T09 · Insecure Skill Coding Practices
Warning
- Location
子模块/内容创作模块/scripts/convert_to_html.py:125- Finding
Stored HTML and Script Injection in Markdown Conversion
- Content
View full analysis
{cell}') ``` ```python for row in table_rows: result.append('{cell}') for cell in row: result.append(f'') result.append('') ``` ```python def convert_images(self, text): pattern = r'!\[([^\]]*)\]\(([^)]+)\)' def replace_image(match): alt = match.group(1) url = match.group(2).strip() if not url or '占位符' in url or 'placeholder' in url.lower(): return f'[图片: {alt}]' return f'' return re.sub(pattern, replace_image, text) ``` ```python def convert_links(self, text): pattern = r'\[([^\]]+)\]\(([^)]+)\)' def replace_link(match): text = match.group(1) url = match.group(2).strip() return f'{text}' return re.sub(pattern, replace_link, text) ``` ```python def convert_html_blocks(self, text): return text ``` ### Technical Analysis The converter defines an `escape_html()` helper but does not apply it to table cells, headings, link text, image alternative text, URLs, or general article content. It also explicitly preserves existing raw HTML. Consequently, attacker-controlled Markdown can introduce arbitrary HTML into generated preview documents. Exploitable payload types include: - Raw `
- Remediation
View remediation