Fix backslash-unaware pipe escaping in markdown tables

[elhoim]

Finding 34 (Low) — bin/cli.py:409,418,421

Problem

.replace('|','\|') is not backslash-aware, so a value already containing a backslash before a pipe (a Windows path, a regex snippet) becomes backslash-backslash-pipe, which markdown reads as an escaped backslash plus an UNescaped delimiter - breaking the very table row the escaping protects.

Fix

response_to_table() in bin/cli.py escaped pipe characters as '|' for markdown table safety, but did so without first escaping any pre-existing backslashes in the value. A value containing a literal backslash immediately before a pipe (e.g. a Windows path or regex snippet like 'foo|bar') was turned into 'foo\|bar' -- markdown parses that as an escaped backslash followed by an UNescaped pipe delimiter, breaking the very table row the escaping was meant to protect. The fix adds a backslash-escaping replace step before the pipe-escaping replace at all three call sites (dict key/value, list value, scalar value), so any existing backslash is doubled first and the trailing pipe escape remains intact.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

Input chars: f,o,o,\,|,b,a,r (i.e. "foo\|bar"). Buggy chain `.replace("\n"," ").replace("|","\\|")` produced chars f,o,o,\,\,|,b,a,r -- i.e. "foo\\|bar": markdown reads the doubled backslash as one escaped backslash then hits a live, unescaped '|' delimiter, splitting the table row.

After

Same input through the fixed chain `.replace("\n"," ").replace("\\","\\\\").replace("|","\\|")` produced chars f,o,o,\,\,\,| -- three backslashes then an escaped pipe ("foo\\\|bar"): markdown renders that as a literal backslash followed by a literal pipe, keeping the table row intact.

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh