T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/excel.js:31- Finding
CSV Formula Injection in Generated Research Files
- Content
View full analysis
h.title).join(','); fs.writeFileSync(filePath, '\uFEFF' + headerLine + '\n', 'utf-8'); // Append data rows, quoting every field if (records.length > 0) { const dataLines = records.map(r => { return headers.map(h => { const val = r[h.id] == null ? '' : String(r[h.id]); return `"${val.replace(/"/g, '""')}"`; }).join(','); }).join('\n'); fs.appendFileSync(filePath, dataLines + '\n', 'utf-8'); } ``` ### Technical Analysis The CSV writer escapes quotation marks and encloses values in double quotes, but it does not neutralize spreadsheet formula prefixes. Spreadsheet applications may interpret cells beginning with `=`, `+`, `-`, or `@` as formulas even when those values were quoted in the CSV file. Several values written through this function originate from externally controlled sources, including: - Scraped website content - Third-party Excel workbooks - LLM-generated fields - Company and project names - URLs and case descriptions An attacker able to place a formula-prefixed value in one of these sources can cause that value to be retained in a generated CSV file. The vulnerability is triggered when a researcher subsequently opens the file in Excel or another formula-capable spreadsheet application. Escaping double quotes prevents CSV structure corruption, but it does not prevent formula evaluation. ### Attack Path 1. An attacker supplies a third-party order workbook or controls content that will be scraped by the Skill. 2. The attacker places a formula-prefixed value in a field that is propagated to an output record, such as a company name, project name, demand-side name, description, or URL. 3. The record is passed to `writeCsv`. 4. The writer encloses the value in quotation marks but leaves its formula prefix unchang ...[truncated 1225 chars]- Remediation
View remediation