T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export_tutorial.py:96- Finding
Untrusted document resources can trigger arbitrary outbound network requests during export and visual capture
- Content
View full analysis
None: cmd = [ pandoc, str(source), "--resource-path", str(source.parent), "--embed-resources", "--standalone", "--toc", "-o", str(target), ] if title: cmd.extend(["-M", f"pagetitle={title}"]) if css: cmd.extend(["-c", str(css)]) run(cmd) postprocess_html(target, document_date) ``` The resulting HTML is then processed by WeasyPrint without a resource-fetching policy: ```python def export_pdf(browser: str, html_file: Path, pdf_file: Path) -> None: try: from weasyprint import HTML except Exception: export_pdf_with_browser(browser, html_file, pdf_file) return HTML(filename=str(html_file), base_url=str(html_file.parent)).write_pdf(str(pdf_file)) ``` The visual-capture utility also inserts arbitrary SVG contents directly into a temporary HTML document and opens it in a headless browser: ```python def capture_svg(browser: str, svg_file: Path, png_file: Path, width: int, height: int, scale: float) -> None: svg = svg_file.read_text(encoding="utf-8") html = f""" html, body {{ width: {width}px; height: {height}px; margin: 0; overflow: hidden; background: #f5f4ed; }} svg {{ display: block; width: {width}px; height: {height}px; }} ...[truncated 4278 chars]- Remediation
View remediation