T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/market-research.sh:82- Finding
Untrusted Remote HTML and JavaScript Are Downloaded and Executed
- Content
View full analysis
str: """Extract inline script blocks, excluding external references.""" scripts = re.findall(r']*src=)[^>]*>(.*?)', html, re.DOTALL) return "\n".join(s for s in scripts if s.strip()) ``` From `scripts/merge_html.py:83-110`: ```python def merge(files: list, keyword: str = "") -> str: """Merge multiple HTML reports into a single report with navigation.""" reports = [] all_styles = set() all_scripts = [] external_css = set() external_js = set() for f in files: html = f.read_text(encoding="utf-8") title = extract_title(html) subtitle = extract_subtitle(html) body = extract_body(html) style = extract_styles(html) script = extract_scripts(html) order = guess_part_order(title) # Collect external CSS/JS references for m in re.finditer(r']+href="([^"]+)"[^>]*stylesheet', html): external_css.add(m.group(1)) for m in re.finditer(r']+src="([^"]+)"', html): external_js.add(m.group(1)) if style: all_styles.add(style) if script: all_scripts.append(f"// === {title} ===\n{script}") ``` From `scripts/merge_html.py:145-147` and `233-240`: ```python js_links = "\n".join(f'' for url in sorted(externa ...[truncated 3586 chars]- Remediation
View remediation