blacklanternsecurity / writehat

A pentest reporting tool written in Python. Free yourself from Microsoft Word.
GNU General Public License v3.0
1.27k stars 225 forks source link

Page Template header/footer markdown image does not render correctly #81

Closed s0alqasim1d closed 1 year ago

s0alqasim1d commented 1 year ago

When Inserting an image in the page template header or footer, they do not render in the HTML report. Instead you can see the markup tags for the image/figure. After digging into the DOM you can see that the rendered figure seems to be sanitized and its tags were replaced with HTML character entities, here is an example:

image

image

image

image

image

When turned back to real HTML tags, the image renders. Any suggestions on how to approach this?

Edit: How different are the page template's header and footer from the markdown components? both seem to use the custom markdown tag which applies a safestring function, yet those can render images fine.

s0alqasim1d commented 1 year ago

Was able to fix this by employing the use of user_template_replace(markdown, context) in pageTemplate.py function from markdown.py instead of render_markdown(markdown, context) function written below it in the same file but uses a sanitization function before returning the result. No more sanitized html from markdown in header or footer.

image