T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/csv_tool.py:163
- Finding
- YAML Structure Injection Through Unescaped CSV Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/csv_tool.py`, lines 163–175 **Vulnerability Type**: Untrusted data injection into generated YAML **Risk Level**: Medium ### Vulnerable Code ```python def cmd_to_yaml(args): headers, rows, _ = read_csv(args.file) lines = [] for row in rows: lines.append('-') for i, h in enumerate(headers): val = row[i] if i < len(row) else '' lines.append(f' {h}: "{val}"') out = args.output or args.file.rsplit('.', 1)[0] + '.yaml' with open(out, 'w', encoding='utf-8') as f: f.write('\n'.join(lines) + '\n') print(f"Converted {len(rows)} rows → {out}") ``` ### Technical Analysis The YAML converter constructs output through direct string interpolation rather than a context-aware YAML serializer. Both the CSV header `h` and cell value `val` are attacker-controlled and are inserted without escaping quotation marks, backslashes, line breaks, document separators, or other YAML syntax. Although values are surrounded by double quotes, an embedded quote followed by a newline can terminate the intended scalar and introduce additional mappings or YAML documents. Headers are even less constrained because they are emitted directly as mapping keys. The resulting file may therefore contain a YAML structure different from the one intended by the converter. This is a data-to-configuration injection issue classified as `T09: Insecure Skill Coding Practices`. ### Attack Path 1. An attacker prepares a CSV file containing a malicious header or cell value with YAML metacharacters, quotation marks, and embedded line breaks. 2. A user invokes the `to-yaml` command on that CSV file. 3. `cmd_to_yaml` interpolates the malicious content directly into the output document. 4. The generated YAML contains attacker-created keys, values, or document boundaries. 5. If the generated file is subsequently used as application configuration or consumed by an automated process, ...[truncated 657 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Use a maintained YAML serializer with safe dumping instead of constructing YAML through string concatenation. - Serialize both keys and values through the serializer so quotes, control characters, line breaks, and YAML metacharacters are encoded correctly. - If adding a dependency is not acceptable, implement and test strict scalar encoding for YAML keys and values. JSON-compatible quoting may be used for scalar values only after verifying that the resulting syntax is valid YAML. - Reject unexpected control characters and normalize line endings before serialization. - Parse the generated document with a safe YAML parser during tests and verify that its structure exactly matches the source rows. - Add regression tests covering embedded quotes, backslashes, multiline cells, colons, comment markers, document separators, and crafted headers. ]]>