T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:63- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ``` ### Technical Analysis Values read from the log files are inserted directly into JSON and CSV output without format-specific encoding. For JSON output, quotation marks, backslashes, control characters, or embedded newlines in `name`, `ts`, or `val` are not escaped. An attacker-controlled value can therefore terminate a JSON string, inject additional properties or records, or make the entire export invalid. For CSV output, fields containing commas, quotation marks, carriage returns, or newlines are not quoted according to CSV rules. In addition, values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` can be interpreted as formulas when the exported file is opened in spreadsheet software. The precise behavior depends on the spreadsheet application and its security configuration. ### Attack Path 1. An attacker supplies crafted text through a record-creati ...[truncated 1170 chars]- Remediation
View remediation