T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:68- Finding
Unescaped User Input in JSON and CSV Exports
- Content
View full analysis
> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" ``` ### Technical Analysis The export implementation inserts stored record values directly into JSON and CSV output without applying format-specific escaping. For JSON exports, the `value`, `type`, and `time` fields are interpolated into quoted JSON strings. Embedded quotation marks, backslashes, control characters, or newlines are not JSON-escaped. Crafted record content can therefore terminate a string, inject additional JSON properties or objects, or make the export syntactically invalid. For CSV exports, fields are concatenated with commas without CSV quoting or escaping. Values containing commas, quotation marks, carriage returns, or newlines can alter the exported row and column structure. In addition, a value beginning with characters interpreted as spreadsheet formulas, such as `=`, `+`, `-`, or `@`, may be evaluated when a user opens the CSV file in compatible spreadsheet software. The script does not itself evaluate the exported content as shell code. Exploitation depends on a downstream JSON consumer or spreadsheet processing the generated file. ### Attack Path 1. An attacker causes a crafted furniture record to be stored, such as by persuading a user or automation process to invoke a record command with attacker-controlled content. An attacker with access to the user's data directory could also place crafted content directly in a `.log` file. 2. The attacker includes JSON metachara ...[truncated 1347 chars]- Remediation
View remediation