T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:53
- Finding
- Unescaped User-Controlled Data in JSON and CSV Exports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh`, lines 53–73 **Vulnerability Type**: Improper output encoding and spreadsheet formula injection **Risk Level**: Medium ### Vulnerable Code ```bash _export() { local fmt="${1:-json}" local out="$DATA_DIR/export.$fmt" case "$fmt" in json) echo "[" > "$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ``` ### Technical Analysis User-supplied tracking values are stored in log files and subsequently inserted directly into JSON and CSV exports without format-specific encoding. For JSON output, characters such as double quotes, backslashes, control characters, and embedded line breaks are not escaped. A crafted value can therefore terminate the intended JSON string, inject additional properties or objects, or make the exported document syntactically invalid. For CSV output, fields are neither quoted nor escaped. Commas, double quotes, and line breaks can alter the exported row structure. More importantly, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the CSV file is opened in spreadsheet software. The exact effects depend on the spreadsheet application and its security settin ...[truncated 1849 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Generate JSON with a format-aware serializer rather than string interpolation. For example, use `jq` with `--arg` so quotes, backslashes, control characters, and newlines are encoded correctly: ```bash jq -n \ --arg type "$name" \ --arg time "$ts" \ --arg value "$val" \ '{type: $type, time: $time, value: $value}' ``` Accumulate these objects into a valid JSON array rather than manually writing separators. 2. Apply RFC 4180-compatible CSV encoding: - Enclose every field in double quotes. - Replace every embedded double quote with two double quotes. - Preserve embedded commas and line breaks inside quoted fields. - Prefer a tested CSV library or dedicated serialization utility. 3. Mitigate spreadsheet formula injection when exports are intended for spreadsheet use. For user-controlled fields beginning with `=`, `+`, `-`, `@`, tab, or carriage return, prepend an apostrophe or otherwise encode the value according to the target spreadsheet application's safe-import guidance. 4. Add regression tests covering: - Double quotes and backslashes. - Commas and embedded line breaks. - JSON control characters. - Values beginning with spreadsheet formula indicators. - Empty fields and values containing the log delimiter. 5. Document whether CSV files are intended for spreadsheet use and warn users not to bypass spreadsheet import protections. ]]>