T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:67- Finding
Unsafe JSON and CSV Export Serialization
- Content
View full analysis
> "$out" ``` ```bash while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" ``` ### Technical Analysis User-controlled log values are inserted directly into JSON and CSV output without format-appropriate escaping. For JSON exports, quotation marks, backslashes, control characters, or embedded line breaks in `$val` are not escaped. A crafted value can therefore terminate the intended JSON string, inject additional properties or objects, or make the generated document syntactically invalid. For CSV exports, fields are not enclosed in quotes and embedded quotation marks, commas, carriage returns, or line feeds are not escaped according to RFC 4180. In addition, a value beginning with a spreadsheet formula indicator such as `=`, `+`, `-`, or `@` may be interpreted as a formula when the exported file is opened with spreadsheet software. Shell command injection is not present in these lines because the variables are quoted and are passed as data to `printf` or `echo`. The vulnerability occurs when a downstream JSON parser or spreadsheet interprets the exported content. ### Attack Path 1. An attacker supplies or convinces a user to record a crafted entry, for example one containing JSON delimiters or a spreadsheet formula. 2. The entry command writes that value unchanged into a local log file. 3. The user runs `bookworm export json` or `bookworm export csv`. 4. The export function inserts the crafted value into the output without escaping. 5. For JSON, the resulting file is malformed or its intended structure is altered. 6. For CSV, opening the file in formula-enabled spreadsheet software may evaluate the attacker-controll ...[truncated 698 chars]- Remediation
View remediation