T09 · Insecure Skill Coding Practices
Warning
- Location
tools/report_generator.py:69- Finding
Unescaped report content permits active HTML and script injection
- Content
View full analysis
str: """解析Markdown表格为HTML表格""" table_pattern = r'\|([^\n]+)\|\n\|[-:\s|]+\|\n((?:\|[^\n]+\|\n?)+)' def convert_table(match): header_line = match.group(1).strip() body_lines = match.group(2).strip() headers = [h.strip() for h in header_line.split('|') if h.strip()] rows = [] for line in body_lines.split('\n'): if line.strip(): cells = [c.strip() for c in line.split('|') if c.strip()] if cells: rows.append(cells) html = [''] html.append('') return '\n'.join(html) return re.sub(table_pattern, convert_table, content) ``` ```python def _parse_markdown_cont ...[truncated 7336 chars]') html.append('PNG') html.append('SVG') html.append('') html.append('') html.append('') for header in headers: html.append(f'') html.append('') html.append('') for row in rows: html.append('') for i, cell in enumerate(row): if i < len(headers): html.append(f'') html.append('') html.append('') html.append('{self._format_cell_content(header)} {self._format_cell_content(cell)} - Remediation
View remediation
` elements - `` payloads - `` elements - Attribute quote-breaking payloads - `javascript:` and `data:` links - Malicious HTML in titles, headings, tables, and ordinary paragraphs 10. Treat all text obtained from web research and user-provided Markdown as untrusted, even when the source is considered credible. ]]>