agent-infra / agent-infra/sandbox

examples/site-to-markdown: raw HTML injected into f-string inside triple-quote literal

未關閉
#178 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
5.9k
分支
529
平均合併
4 小時 8 分鐘
30 天內合併 PR
4

描述

## Description

`examples/site-to-markdown/main.py` builds Jupyter code dynamically by interpolating scraped page HTML into an outer f-string that contains inner triple-quoted string literals:

```python
code=f"""
from markdownify import markdownify
html = '''{html}'''
screenshot_b64 = "{screenshot_b64}"
...
"""
```

If the scraped page contains `'''` anywhere in its markup (or an attacker-controlled page does), the inner triple-quote is terminated early and the rest of `{html}` is parsed as Python source. The sandbox then executes that Python. Similarly, raw backslashes in the HTML can produce SyntaxErrors or break escape sequences.

## Impact

Since the same sandbox is used for other user code, an attacker who controls any page the user scrapes can execute code inside their sandbox environment. Even without malice, perfectly legitimate pages with inline code samples using triple quotes will break the example.

## Fix

Base64-encode the HTML on the host, then decode inside the sandbox. Only 7-bit-safe ASCII crosses the f-string boundary, so no content of the scraped page can alter the generated Python source.

PR forthcoming.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。