Vulnerable code sample

import mistune
from mistune.plugins import plugin_toc

# This code represents the behavior of mistune < 3.3.0.
# An attacker provides Markdown with an embedded HTML element that has a
# predictable ID, "toc_2".
malicious_markdown = """
# First Heading

This is some legitimate content.

<div id="toc_2">
  <p>This is an attacker-controlled element. The link for "Second Legitimate Heading" will incorrectly point here.</p>
</div>

# Second Legitimate Heading

This is the content that should be the target of the second TOC link, but its ID will collide with the element above.

# Third Legitimate Heading

More content.
"""

# The state dictionary is used by the plugin to store the generated TOC data.
state = {}

# Initialize the markdown parser with `escape=False` to allow raw HTML injection.
# The `plugin_toc` in vulnerable versions creates sequential IDs like toc_1, toc_2, etc.
markdown_parser = mistune.create_markdown(
    escape=False,
    plugins=[plugin_toc(state=state)]
)

# Render the markdown.
# The resulting HTML will contain two elements with `id="toc_2"`.
# In a browser, a link to `#toc_2` will navigate to the first one encountered,
# which is the attacker's injected div.
html_output = markdown_parser(malicious_markdown)

# The following would print the problematic HTML and the generated TOC.
# print("--- Rendered HTML ---")
# print(html_output)
# print("\n--- Generated TOC Data ---")
# print(state['toc'])
#
# Expected 'toc' data:
# [(1, 'First Heading', 'toc_1'), (1, 'Second Legitimate Heading', 'toc_2'), (1, 'Third Legitimate Heading', 'toc_3')]
# A TOC renderer would create a link <a href="#toc_2">, which leads to the attacker's div.