T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:65- Finding
Unescaped User Input in JSON and CSV Exports
- Content
View full analysis
> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" ``` ```bash echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ``` ### Technical Analysis The export implementation inserts stored, user-controlled values directly into JSON and CSV documents without applying the encoding rules of either format. For JSON exports, quotation marks, backslashes, control characters, and embedded newlines in `$val` are not escaped. A crafted value can therefore produce invalid JSON or alter the apparent structure of the exported document. This creates a data-integrity risk for users or downstream applications that parse the generated file. For CSV exports, fields are neither enclosed in quotation marks nor escaped according to RFC 4180. Commas, quotation marks, and newlines can create additional columns or records. In addition, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` are written verbatim. When the CSV is opened in software that evaluates formulas, the value may be interpreted as an active spreadsheet formula rather than inert text. The script does quote shell variables during command invocation, so this issue does not constitute shell command injection into the script itself. ### Attack Path 1. An attacker persuades a user or an automated integration to save an attacker-controlled book entry, for example: ```text =HYPERLINK("https://attacker.invalid/collect","Open book details") ``` Alternatively, t ...[truncated 1477 chars]- Remediation
View remediation