T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-legal-letter.sh:58- Finding
Untrusted Markdown Processed by Active Document Renderers
- Content
View full analysis
/dev/null; then pandoc "$INPUT" \ --pdf-engine=wkhtmltopdf \ --variable margin-top=2cm \ --variable margin-bottom=2cm \ --variable margin-left=3cm \ --variable margin-right=2cm \ --metadata title="法律函件" \ -o "$OUTPUT" elif command -v weasyprint &>/dev/null; then pandoc "$INPUT" \ --pdf-engine=weasyprint \ -o "$OUTPUT" else ``` ### Technical Analysis The script accepts an arbitrary Markdown file through `--input` and passes it directly to Pandoc with either `wkhtmltopdf` or `weasyprint` as the PDF rendering engine. It does not sanitize raw HTML, external resource URLs, embedded images, stylesheets, scripts, or unsafe URI schemes before rendering. Markdown processed by Pandoc can contain raw HTML and references to remote resources. Depending on the installed renderer and its security configuration, document conversion may cause the renderer to make HTTP requests to attacker-selected or internal network addresses. Some wkhtmltopdf configurations may also execute embedded JavaScript or permit access to local resources. The shell variables are quoted, so this code does not establish shell command injection. The risk instead arises inside the document-rendering pipeline, where untrusted document content is interpreted by feature-rich third-party renderers. ### Attack Path 1. An attacker supplies dispute details or Markdown content containing raw HTML or a reference to a controlled resource, such as an image or stylesheet URL. 2. That content is saved into the Markdown input fi ...[truncated 1244 chars]- Remediation
View remediation