T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:201
- Finding
- Spreadsheet Formula Injection in CSV Export<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:35` and `scripts/script.sh:201-204` **Vulnerability Type**: CSV/spreadsheet formula injection caused by insufficient output neutralization **Risk Level**: Medium ### Vulnerable Code ```bash ticker=$(echo "$1" | tr '[:lower:]' '[:upper:]') ``` ```python elif fmt == 'csv': print('ticker,quantity,avg_price,value,date_added') for h in holdings: val = round(h['quantity'] * h['avg_price'], 2) print(f"{h['ticker']},{h['quantity']},{h['avg_price']},{val},{h.get('date_added','')}") ``` ### Technical Analysis The `add` command accepts an arbitrary ticker string and only converts lowercase characters to uppercase. It does not enforce a valid ticker syntax or reject spreadsheet control prefixes such as `=`, `+`, `-`, and `@`. The `list --format csv` command then constructs CSV records with direct string interpolation. It neither uses a standards-compliant CSV encoder nor neutralizes formula-like fields. Consequently, a ticker beginning with a formula prefix is written into the first CSV column unchanged. Spreadsheet applications may interpret such fields as formulas when a user opens the exported file. Quoting a field alone is not sufficient protection in all spreadsheet applications; formula-prefix neutralization is also required. ### Attack Path 1. An attacker, untrusted caller, or agent-mediated input supplies a formula-like ticker: ```bash bash scripts/script.sh add '=1+1' 10 100 ``` 2. The ticker is stored unchanged except for uppercase conversion. 3. A user exports the portfolio: ```bash bash scripts/script.sh list --format csv > portfolio.csv ``` 4. The resulting file contains a formula-like cell: ```csv ticker,quantity,avg_price,value,date_added =1+1,10.0,100.0,1000.0,2026-09-12 ``` 5. When the CSV file is opened in compatible spreadsheet software, the ticker cell may be evaluated as a formula. 6. A more capable spreadsheet formula ...[truncated 856 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce an explicit allowlist for ticker symbols before storing them. For example: ```bash if [[ ! "$ticker" =~ ^[A-Z0-9][A-Z0-9._-]{0,15}$ ]]; then echo "Invalid ticker format." >&2 return 1 fi ``` 2. Generate CSV output with Python's standard `csv` module instead of manual string interpolation: ```python import csv import sys writer = csv.writer(sys.stdout) writer.writerow(['ticker', 'quantity', 'avg_price', 'value', 'date_added']) ``` 3. Neutralize spreadsheet formulas in every textual CSV field. Prefix values beginning with `=`, `+`, `-`, or `@` with an apostrophe: ```python def spreadsheet_safe(value): text = str(value) if text.startswith(('=', '+', '-', '@')): return "'" + text return text ``` 4. Apply neutralization to all attacker-controlled textual fields, including values loaded from pre-existing or manually modified JSON files. 5. Add regression tests covering formula prefixes, commas, quotation marks, line breaks, and ordinary ticker symbols. ]]>