T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/finance_tools.py:270- Finding
Unsanitized CSV Content Allows Terminal Escape-Sequence Injection
- Content
View full analysis
12,.2f}") # Line 201: attacker-controlled CSV column name print(f" {col}: 合计={sums[col]:>12,.2f} 平均={avg:>10,.2f}") # Line 270: attacker-controlled category value print(f" {bar} {cat:<20} {val:>12,.2f} ({pct:5.1f}%)") # Line 398: attacker-controlled date or month value print(f" {m:<10} {val:>10,.2f} {mom_str:>9} {yoy_str:>9}") # Line 420: attacker-controlled year derived from a date value print(f" {y}: {by_year[y]:>12,.2f} (同比 {growth:+.1f}%)") # Line 508: attacker-controlled date or month value print(f" {m}: {v:>12,.2f} {change:<10}") ``` ### Technical Analysis The application reads CSV headers and field values and writes them directly to an interactive terminal. Values used as column names, category labels, dates, months, and years are not sanitized before being passed to `print()`. Terminal emulators interpret certain control characters as commands rather than visible text. In particular, attacker-controlled ANSI CSI and OSC sequences can alter colors, move the cursor, erase or overwrite previously displayed output, change terminal titles, create deceptive hyperlinks, or perform other terminal-dependent actions. Some terminal configurations may also permit clipboard operations through OSC sequences. This issue does not constitute shell-command injection: the values are not passed to a shell, `eval`, `exec`, or a subprocess. Exploitation is limited to capabilities exposed by the terminal emulator and its configuration. ### Attack Path 1. An attacker creates or modifies a CSV file that the victim is expected to analyze. 2. The attacker embeds terminal control sequences in a supported field, such ...[truncated 1361 chars]- Remediation
View remediation
12,.2f} ({pct:5.1f}%)") ``` The production sanitizer should be tested against complete multi-character terminal escape sequences and all supported output paths. ]]>