T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/boss.py:88
- Finding
- Spreadsheet Formula Injection Through Untrusted Job Data## Vulnerability Details **File Location**: `scripts/boss.py`, lines 88-106 **Vulnerability Type**: CSV formula injection **Risk Level**: Medium ### Vulnerable Code ```python job_info = { '岗位名称': job.get('jobName', ''), '公司': job.get('brandName', ''), '规模': job.get('brandScaleName', ''), '公司领域': job.get('brandIndustry', ''), '学历要求': job.get('jobDegree', ''), '经验要求': job.get('jobExperience', ''), '技能需求': job.get('skills', []), '福利待遇': job.get('welfareList', []), '薪资': parse_month_salary(job.get('salaryDesc', '')), '市': job.get('cityName', ''), '区': job.get('areaDistrict', ''), '商圈': job.get('businessDistrict', ''), '经度': job.get('gps', {}).get('longitude', ''), '纬度': job.get('gps', {}).get('latitude', '') } csv_writer.writerow(job_info) ``` ### Technical Analysis Job attributes received from the external BOSS Zhipin API are copied directly into a CSV row without spreadsheet-specific output neutralization. CSV quoting performed by `csv.DictWriter` protects CSV structure but does not prevent spreadsheet applications from interpreting cell content as formulas. An attacker able to publish or influence a job listing could begin a string field with a formula indicator such as `=`, `+`, `-`, or `@`. When the generated file is opened in a compatible spreadsheet application, the cell may be evaluated rather than treated as literal text. The precise result depends on the spreadsheet product and its security configuration. ### Attack Path 1. An attacker publishes a job listing containing a formula-like value in a field such as the job name, company name, skills, or benefits. 2. The BOSS Zhipin API returns the attacker-controlled value in a job-list response. 3. `boss.py` retrieves the value through `job.get(...)`. 4. `csv_writer.writerow(job_info)` writes it into `boss.csv` without neutralization. 5. The user opens the CSV in spreadsheet software. ...[truncated 647 chars]
- Remediation
- ## Remediation Suggestions Treat every string obtained from the recruitment service as untrusted. Before writing a value to CSV: 1. Convert list and scalar values into explicit strings. 2. Detect values whose first non-whitespace character is `=`, `+`, `-`, or `@`. 3. Prefix dangerous values with an apostrophe or another neutralization character appropriate for the intended spreadsheet application. 4. Apply neutralization recursively to values obtained from lists. 5. Consider generating XLSX output with scraped values explicitly stored as text cells. 6. Add tests covering formula prefixes, leading whitespace, tabs, carriage returns, and newline-prefixed formulas. Example hardening logic: ```python def spreadsheet_safe(value): if isinstance(value, list): value = ", ".join(str(item) for item in value) else: value = str(value) if value.lstrip().startswith(("=", "+", "-", "@")): return "'" + value return value safe_job_info = { key: spreadsheet_safe(value) for key, value in job_info.items() } csv_writer.writerow(safe_job_info) ```