T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:60- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` ### Technical Analysis Command arguments are persisted in log files and later assigned to `val`. The export routine inserts this value directly into JSON and CSV output without format-specific encoding. For JSON exports, characters such as double quotes, backslashes, control characters, and embedded line breaks are not escaped. A value containing syntax such as `"}` or additional property delimiters can make the generated document invalid or alter its interpreted structure. For CSV exports, fields containing commas, double quotes, or line breaks are not quoted according to CSV rules. In addition, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` are not neutralized. If the exported file is opened in spreadsheet software that evaluates formulas, attacker-con ...[truncated 1951 chars]- Remediation
View remediation