T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:68- Finding
Unsafe JSON and CSV Serialization Enables Export Injection
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` ### Technical Analysis Roadmap entry values are derived from command-line input and stored verbatim in log files. During export, the script directly interpolates those values into JSON and CSV without applying format-specific encoding. For JSON exports, characters such as double quotes, backslashes, carriage returns, and newlines are not escaped. An attacker-controlled value can therefore invalidate the JSON document or inject additional JSON properties or objects into the exported representation. For CSV exports, fields are not quoted and embedded quotes, commas, carriage returns, and newlines are not escaped according to CSV rules. In addition, cells beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` are written unchanged. When the resulting file is opened in spreadsheet software, such content may be interpreted as a formula rather than inert text. Shell argument quoting prevents this value from becoming shell code inside the script itself. The security boundary is instead crossed when an exported CSV file is opened by a formul ...[truncated 1526 chars]- Remediation
View remediation