T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:65- Finding
Unsafe JSON and CSV Export of User-Controlled Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh:65-82
Vulnerability Type: Improper output encoding and spreadsheet formula injection
Risk Level: MediumVulnerable Code
bash json) echo "[" > "$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;;Technical Analysis
Entry values originate from command-line arguments and are persisted without restrictions in command-specific log files and
history.log. The export implementation subsequently interpolates these values directly into JSON and CSV output.The JSON exporter does not escape quotation marks, backslashes, or control characters. An entry containing JSON syntax can therefore terminate the intended
valuestring, add arbitrary properties or objects, or make the export syntactically invalid.The CSV exporter neither quotes fields nor escapes embedded commas, quotation marks, carriage returns, or newlines. It also does not neutralize values beginning with spreadsheet formula prefixes such as
=,+,-, or@. If such an export is opened in a spreadsheet application, attacker-controlled content may be interpreted as a formula rather than inert t ...[truncated 1749 chars]- Remediation
View remediation
Remediation Suggestions
- Replace manual JSON construction with a standards-compliant serializer. For example, pass records to Python's
jsonmodule so quotation marks, backslashes, Unicode, and control characters are escaped correctly. - Replace manual CSV concatenation with a CSV library such as Python's
csvmodule. Quote all fields and correctly escape embedded quotation marks, delimiters, and line endings. - If CSV files are expected to be opened in spreadsheet software, neutralize cells whose first non-whitespace character is
=,+,-, or@. A documented defensive prefix such as an apostrophe can be applied while preserving the original value separately when exact round-trip fidelity is required. - Validate generated exports before reporting success. Parse JSON output with a conforming parser and test CSV output with representative values containing commas, quotes, newlines, formula prefixes, backslashes, and control characters.
- Consider using a structured storage format internally rather than parsing pipe-delimited text, because user-controlled pipe characters and line breaks can also make records ambiguous.
- Add regression tests covering JSON structural injection, malformed records, CSV row injection, and spreadsheet formula injection.
- Replace manual JSON construction with a standards-compliant serializer. For example, pass records to Python's