T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/push_draft.py:564- Finding
Failed HTML image processing silently preserves third-party tracking URLs
- Content
View full analysis
，上传并替换为微信 URL print("[2/5] 正文插图 -> 素材库") html = body_html img_count = 0 for img_m in re.finditer(r']*\bsrc="([^"]+)"[^>]*>', html, flags=re.I): src_raw = img_m.group(1).strip() # 转义形态（匹配 html 原文，用于替换） src = re.sub(r"[\x00-\x1f\x7f]+", "", html.unescape(src_raw)).strip() # 解码后用于下载 # 跳过已经是微信CDN的图、data URI、空src if not src or src.startswith("data:") or "mmbiz" in src: continue try: local = _ensure_local(src, html_dir) url = upload_img(token, local) html = html.replace(f'src="{src_raw}"', f'src="{url}"', 1) img_count += 1 print(f" {src[:50]} -> {url[:44]}...") except Exception as e: print(f" [warn] 图片上传失败 {src[:50]}: {e}") ``` ### Technical Analysis The local variable `html` is assigned the article body as a string. The code then calls `html.unescape(src_raw)`, but strings do not provide an `unescape` method. The intended operation was presumably `html.unescape()` from Python's standard `html` module. Consequently, processing an eligible image raises `AttributeError` before `_ensure_local()` or `upload_img()` can replace the source with a WeChat CDN URL. The broad `except Exception` handler converts the failure into a warning and permits the pipeline to continue. The subsequent validator accepts arbitrary `http://` and `https://` image sources. Therefore, a failed upload does not block publication, and the original third-party URL can remain in the draft. This contradicts the documented behavior that article images are uploaded and replaced with WeChat-hosted URLs. ### Attack Path 1. An attacker supplies or influences an HTML article containing an image such as: ```html ...[truncated 1440 chars]- Remediation
View remediation