[LOTP] Add mdformat

[fproulx-boostsecurity]

Description of the LOTP tool

mdformat is markdown formatting tool that can be configured we a config file.

Configuration files

.mdformat.toml

Documentation

https://mdformat.readthedocs.io/en/stable/users/configuration_file.html

Real-world example

Seen in the wild...

[Talgarr]

After some research:

• The config file can be a symlink, but it is still loaded as a TOML file and the key and value are checked, so probably no way to Arbitrary Read.
• We can modify an Abitrary file via a symlink, but the modification is from the parser which doesn't allow custom format rules.
• The modules are loaded via importlib_metadata.entry_points(group="mdformat.parser_extension"), which only check the PATH for python module, which prevent the creation of a malicious package.

Not checked: the list of format extension here.