T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:53- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ``` ### Technical Analysis User-supplied tracking values are stored in log files and subsequently inserted directly into JSON and CSV exports without format-specific encoding. For JSON output, characters such as double quotes, backslashes, control characters, and embedded line breaks are not escaped. A crafted value can therefore terminate the intended JSON string, inject additional properties or objects, or make the exported document syntactically invalid. For CSV output, fields are neither quoted nor escaped. Commas, double quotes, and line breaks can alter the exported row structure. More importantly, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the CSV file is opened in spreadsheet software. The exact effects depend on the spreadsheet application and its security settin ...[truncated 1849 chars]- Remediation
View remediation