T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:64- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 64-81
Vulnerability Type: Improper output encoding and CSV formula injection
Risk Level: MediumVulnerable Code
bash json) echo "[" > "$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;;Technical Analysis
The export implementation inserts log-file content directly into JSON strings and CSV fields without context-appropriate output encoding.
For JSON exports, characters such as double quotes, backslashes, carriage returns, and control characters are not escaped. A crafted value can terminate the intended JSON string, inject additional properties or objects, or make the export syntactically invalid. Shell quoting only protects the shell command invocation; it does not perform JSON encoding.
For CSV exports, fields are concatenated with commas without RFC 4180 quoting. Values containing commas, quotes, carriage returns, or newlines can alter record and column boundaries. In addition, a value beginning with
=,+,-, or@may be interpreted as a formula when the resulting file is opened in spreadsheet software. Depending on the spreadsheet ...[truncated 2461 chars]- Remediation
View remediation
Remediation Suggestions
- Generate JSON using a proper JSON serializer rather than string interpolation. Ensure every string field is escaped for quotes, backslashes, control characters, and embedded line breaks.
- Produce CSV according to RFC 4180:
- Enclose every field in double quotes.
- Replace each embedded double quote with two double quotes.
- Preserve record boundaries safely when values contain newlines.
- Neutralize spreadsheet formulas in fields that may be opened by spreadsheet software. Prefix values beginning with
=,+,-,@, tab, or carriage return with a safe character such as an apostrophe, while documenting this transformation. - Validate the stored record format. Reject or safely encode embedded newlines and delimiter characters when records are written.
- Add regression tests covering quotes, backslashes, commas, pipes, newlines, control characters, and formula-leading values.
- Correct the top-level
localdeclarations in command branches so functional testing can exercise the complete input-to-export path. - Treat generated exports as untrusted data and warn users before opening CSV files in applications capable of evaluating formulas.