T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/tasks_to_kanban.py:14
- Finding
- CSV Formula Injection in Kanban Export## Vulnerability Details **File Location**: `scripts/tasks_to_kanban.py`, lines 14–15 **Vulnerability Type**: CSV formula injection **Risk Level**: Medium ### Vulnerable Code ```python for t in tasks: w.writerow({k: t.get(k, "") for k in fields}) ``` ### Technical Analysis The script copies task values from a user-supplied JSON document directly into CSV cells without neutralizing spreadsheet formula prefixes. Values whose first non-whitespace character is `=`, `+`, `-`, or `@` may be interpreted as formulas when the resulting CSV file is opened in spreadsheet software. CSV quoting does not prevent this behavior because spreadsheet applications can evaluate formula syntax inside correctly quoted fields. An attacker-controlled meeting transcript or task document could therefore introduce a value such as: ```text =HYPERLINK("https://attacker.example","Open task details") ``` The script would preserve that value in the generated CSV. Exploitability and exact behavior depend on the spreadsheet application and its security settings. ### Attack Path 1. An attacker supplies meeting content or task data containing a formula-prefixed field. 2. The content is converted into a JSON task whose `title`, `owner`, `due`, `priority`, `status`, or `notes` field contains the payload. 3. The script loads the attacker-influenced JSON file. 4. Lines 14–15 write the field into the CSV without sanitization. 5. A recipient opens the generated CSV in spreadsheet software. 6. The spreadsheet interprets the field as a formula or presents attacker-controlled formula output. 7. Depending on application protections and user interaction, the formula may expose deceptive links, trigger external resource requests, or invoke dangerous legacy spreadsheet functionality. ### Impact Assessment The script itself does not gain additional operating-system privileges and does not execute the payload during CSV generation. The impact occurs in the context of the user who later opens the C ...[truncated 557 chars]
- Remediation
- ## Remediation Suggestions Sanitize every text value before passing it to `csv.DictWriter`. If the first non-whitespace character is `=`, `+`, `-`, or `@`, prefix the value with an apostrophe or otherwise encode it according to the requirements of the target spreadsheet application. For example: ```python def sanitize_csv_cell(value): if value is None: return "" value = str(value) if value.lstrip().startswith(("=", "+", "-", "@")): return "'" + value return value for t in tasks: w.writerow({ k: sanitize_csv_cell(t.get(k, "")) for k in fields }) ``` Additional hardening should include: 1. Validate that the parsed JSON root is a list and that every task is an object. 2. Convert non-string field values explicitly rather than relying on implicit CSV serialization. 3. Document that exported files may contain untrusted meeting content. 4. Add automated regression tests covering formula-prefixed values, including values with leading spaces, tabs, and line breaks. 5. Test generated files with the spreadsheet applications expected to consume them, because formula-neutralization behavior can vary by application.