T09 · Insecure Skill Coding Practices
Error
- Location
src/converter.py:387- Finding
Unsanitized HTML and Title Injection into the wkhtmltopdf Rendering Context
- Content
View full analysis
str: """ Convert markdown to HTML. Args: markdown_text: Markdown text to convert. title: Document title. Returns: HTML string. """ # Replace emoji with PDF-compatible colored text labels markdown_text = replace_emoji_for_pdf(markdown_text, use_color=True) # Convert markdown to HTML with extensions html = markdown.markdown( markdown_text, extensions=[ 'extra', 'codehilite', 'toc', 'tables', 'fenced_code', 'nl2br' ] ) css = self.generate_css() # Add HTML structure with theme html_template = f""" {title} {css} {html} """ return html_template ``` The resulting HTML is then passed directly to the rendering engine: ```python pdfkit.from_string( html, str(output_path), options={ 'page-size': page_size, 'margin-top': margin, 'margin-right': margin, 'margin-bottom': margin, 'margin-left': margin, 'encoding': 'UTF-8', 'no-outline': None, 'print-media-type': None } ) ``` ```python imgkit.from_string( html, str(output_path), options={ 'width': width, 'format': 'png', 'quality': quality } ) ``` ### Technical Analysis The Markdown input is converted to HTML without an HTML sanitization stage. Python Markdown can preserve raw HTML ...[truncated 3033 chars]- Remediation
View remediation
`, ``, remote images, loopback URLs, internal addresses, `file:` URLs, event-handler attributes, and title-element breakout attempts. ]]>