T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wechat_formatter.py:76- Finding
Unescaped HTML and Unsafe URL Scheme Injection in WeChat Output
- Content
View full analysis
{line[3:]}') elif line.startswith("### "): html_parts.append(f'{line[4:]} ') elif line.startswith("> "): html_parts.append(self.QUOTE_STYLE.format(text=line[2:])) elif line.startswith("- ") or line.startswith("* "): html_parts.append(f'🔹 {line[2:]} ') elif re.match(r"^\d+\.\s", line): html_parts.append(f'📌 {re.sub(r"^\d+\.\s", "", line)} ') else: text = self._inline_format(line) if text.strip(): html_parts.append(self.PARAGRAPH_STYLE.format(text=text)) html_body = "\n".join(html_parts) return f"""{html_body} {self.FOOTER} """.strip() ``` The link conversion performed by `_inline_format` also inserts an unvalidated destination into an HTML attribute: ```python text = re.sub(r"\[(.*?)\]\((.*?)\)", r'\1', text) return text ``` ### Technical Analysis The formatter directly interpolates user-controlled article content into HTML elements without first applying HTML escaping. This affects headings, quotations, list items ...[truncated 2257 chars]- Remediation
View remediation