T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:61- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ``` ### Technical Analysis The export implementation inserts values read from local log files directly into JSON and CSV output without format-specific encoding. For JSON exports, characters such as double quotes, backslashes, control characters, and embedded newlines are not escaped. A crafted value can therefore invalidate the JSON document or terminate the intended string and inject additional JSON fields or objects. The implementation should not build JSON through string interpolation. For CSV exports, fields are neither quoted nor escaped. Commas and newlines can introduce additional columns or records. More importantly, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the resulting file is opened in spreadsheet software. Depending on the spreadsheet and its security configuration, formulas may initiate external requests, expose spreadsheet data, or invoke dangerous application fe ...[truncated 1917 chars]- Remediation
View remediation