T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:74- Finding
CSV Formula Injection in Exported Roadmap Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 74–79
Vulnerability Type: CSV formula injection caused by unsafe serialization of user-controlled data
Risk Level: MediumVulnerable Code
bash csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;;Technical Analysis
The
valuefield originates from command-line input and is persisted in a log without validation. During CSV export, the script writes this user-controlled value directly into a CSV row without applying CSV quoting, escaping embedded delimiters, or neutralizing spreadsheet formula prefixes.Spreadsheet applications may interpret cells beginning with characters such as
=,+,-, or@as formulas. Consequently, an attacker who can persuade a user to save crafted content can cause the subsequent CSV export to contain an executable spreadsheet formula rather than inert text.The lack of CSV quoting also allows commas, quotation marks, and line breaks in an entry to alter the exported row or create additional cells and records, making it easier to position malicious formula content.
Attack Path
- An attacker supplies or recommends a crafted roadmap entry beginning with a spreadsheet formula marker, for example a value beginning with
=. - The victim invokes a content command such as
ml-roadmap draftwith that value. - The script stores the attacker-controlled value in a log under
~/.local/share/ml-roadmap/. - The victim runs
ml-roadmap export csv. - Lines 74–79 copy the value into
export.csvwithout safe CSV encoding or formula neutralization. - The victim opens the exported file in a spreadsheet application.
- If that application evaluates formulas from imported CSV files, the in ...[truncated 672 chars]
- An attacker supplies or recommends a crafted roadmap entry beginning with a spreadsheet formula marker, for example a value beginning with
- Remediation
View remediation
Remediation Suggestions
- Replace manual comma concatenation with a standards-compliant CSV encoder.
- Quote every field and escape embedded quotation marks by doubling them according to RFC 4180.
- Preserve embedded commas and line breaks as quoted field content rather than allowing them to create new cells or rows.
- Neutralize fields whose first non-whitespace character is
=,+,-, or@. A common defensive approach is to prefix such values with an apostrophe, subject to the requirements of the target spreadsheet applications. - Apply neutralization to every exported field that can be influenced by external or stored data, not only the
valuefield. - Add tests covering formula prefixes, commas, quotation marks, carriage returns, and line feeds.
- Document that exported files contain user-provided content and should be treated as untrusted when opened in spreadsheet software.