T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vendor/baoyu-md/src/extensions/plantuml.ts:122- Finding
PlantUML source is automatically disclosed to a public rendering service
- Content
View full analysis
, ): string { const encoded = encodePlantUML(code) const formatPath = options.format === `svg` ? `svg` : `png` return `${options.serverUrl}/${formatPath}/${encoded}` } ``` ```ts async function fetchSvgContent(svgUrl: string): Promise { try { const response = await fetch(svgUrl) if (!response.ok) { throw new Error(`HTTP ${response.status}`) } const svgContent = await response.text() return svgContent .replace(/(]*)\swidth="[^"]*"/g, `$1`) .replace(/(]*)\sheight="[^"]*"/g, `$1`) .replace(/(]*style="[^"]*?)width:[^;]*;?/g, `$1`) .replace(/(]*style="[^"]*?)height:[^;]*;?/g, `$1`) } catch (error) { console.warn(`Failed to fetch SVG content from ${svgUrl}:`, error) return `PlantUML diagram loading failed` } } ``` ```ts export function markedPlantUML( options: PlantUMLOptions = {}, ): MarkedExtension { const resolvedOptions: Required = { serverUrl: options.serverUrl || `http ...[truncated 2106 chars]- Remediation
View remediation