T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils.py:454- Finding
Persistent Markdown and Mermaid Injection Through Unescaped Worklog Data
- Content
View full analysis
str: """生成 Markdown 格式表格。 Args: headers: 表头列表。 rows: 数据行列表，每行为字符串列表。 Returns: Markdown 表格字符串。 """ if not headers: return "" lines = [] # 表头 lines.append("| " + " | ".join(str(h) for h in headers) + " |") # 分隔线 lines.append("| " + " | ".join("---" for _ in headers) + " |") # 数据行 for row in rows: # 确保行的列数与表头一致 padded = list(row) + [""] * (len(headers) - len(row)) lines.append("| " + " | ".join(str(c) for c in padded[:len(headers)]) + " |") return "\n".join(lines) ``` A stored task description and other worklog fields are passed directly to that table builder: ```python for name, info in sorted(by_member.items()): md_lines.append(f"### {name}") md_lines.append("") detail_headers = ["日期", "任务", "项目", "分类", "工时"] detail_rows = [] for task in sorted(info["tasks"], key=lambda t: t["date"]): detail_rows.append([ task["date"], task["task_description"], task.get("project", "-"), task.get("category", "其他"), format_hours(task.get("hours", 0)), ]) md_lines.append(build_markdown_table(detail_headers, detail_rows)) md_lines.append("") ``` Member and project names are also interpolated directly into Mermaid syntax: ```python if by_ ...[truncated 4599 chars]- Remediation
View remediation