T09 · Insecure Skill Coding Practices
Warning
- Location
fortune500_fetch.py:94- Finding
Untrusted Remote Data Written to Excel Without Formula Neutralization
- Content
View full analysis
= 4: try: rank = int(cells[0].text.strip()) company = cells[1].text.strip() industry = cells[2].text.strip() revenue = cells[3].text.strip() companies.append({ 'rank': rank, 'company': company, 'industry': industry, 'revenue': revenue }) except (ValueError, IndexError): continue ``` ```python # Add company data for idx, company in enumerate(companies, 2): ws.cell(row=idx, column=1, value=company['rank']) ws.cell(row=idx, column=2, value=company['company']) ws.cell(row=idx, column=3, value=company['industry']) ws.cell(row=idx, column=4, value=company['revenue']) ws.cell( row=idx, column=5, value=f'{url} | 获取时间：{datetime.now().strftime("%Y-%m-%d %H:%M:%S")}' ) ``` ### Technical Analysis The `company`, `industry`, and `revenue` values originate from a remote webpage and are written directly into an XLSX workbook without validation or formula neutralization. Openpyxl interprets a string beginning with `=` as an Excel formula. Consequently, if the remote data source returns a value such as `=HYPERLINK(...)` or another formula expression, the generated workbook can contain an active formula rather than inert text. This could occur if the upstream website is compromised, its content-management pipeline is abused, or unexpected attacker-contr ...[truncated 2100 chars]- Remediation
View remediation