Description
examples/site-to-markdown/main.py builds Jupyter code dynamically by interpolating scraped page HTML into an outer f-string that contains inner triple-quoted string literals:
code=f"""
from markdownify import markdownify
html = '''{html}'''
screenshot_b64 = "{screenshot_b64}"
...
"""If the scraped page contains ''' anywhere in its markup (or an attacker-controlled page does), the inner triple-quote is terminated early and the rest of {html} is parsed as Python source. The sandbox then executes that Python. Similarly, raw backslashes in the HTML can produce SyntaxErrors or break escape sequences.
Impact
Since the same sandbox is used for other user code, an attacker who controls any page the user scrapes can execute code inside their sandbox environment. Even without malice, perfectly legitimate pages with inline code samples using triple quotes will break the example.
Fix
Base64-encode the HTML on the host, then decode inside the sandbox. Only 7-bit-safe ASCII crosses the f-string boundary, so no content of the scraped page can alter the generated Python source.
PR forthcoming.
Description
examples/site-to-markdown/main.pybuilds Jupyter code dynamically by interpolating scraped page HTML into an outer f-string that contains inner triple-quoted string literals:If the scraped page contains
'''anywhere in its markup (or an attacker-controlled page does), the inner triple-quote is terminated early and the rest of{html}is parsed as Python source. The sandbox then executes that Python. Similarly, raw backslashes in the HTML can produce SyntaxErrors or break escape sequences.Impact
Since the same sandbox is used for other user code, an attacker who controls any page the user scrapes can execute code inside their sandbox environment. Even without malice, perfectly legitimate pages with inline code samples using triple quotes will break the example.
Fix
Base64-encode the HTML on the host, then decode inside the sandbox. Only 7-bit-safe ASCII crosses the f-string boundary, so no content of the scraped page can alter the generated Python source.
PR forthcoming.