T09 · Insecure Skill Coding Practices
- Location
run_optimization.py:159- Finding
Formula Injection in Generated Excel Reports
- Content
View full analysis
Vulnerability Details
File Location:
run_optimization.py, lines 159-176 and 355-360
Vulnerability Type: Improper neutralization of formula-prefixed spreadsheet data
Risk Level: MediumVulnerable Code
Input values are read from an attacker-supplied Excel workbook without sanitization:
python records = [] for idx, row in df.iterrows(): province = str(row['省']) if pd.notna(row.get('省')) else None city = str(row['市']) if pd.notna(row.get('市')) else None district = str(row['区']) if pd.notna(row.get('区')) else '全区域' if not city: continue if not province or province == 'nan': province = city_to_province.get(city, city + '市') records.append({ '省份': province, '城市': city, '区县': district, })The values are subsequently written directly into the generated workbook:
python ws3[f'A{row}'] = best_rdc['name'] ws3[f'B{row}'] = tc_name ws3[f'C{row}'] = fsl_name ws3[f'D{row}'] = province ws3[f'E{row}'] = city ws3[f'F{row}'] = districtTechnical Analysis
The province, city, and district fields originate from the user-provided store workbook. No validation or formula neutralization is applied before these strings are assigned to cells in the output workbook.
In particular, OpenPyXL treats a string beginning with
=as a formula when it is assigned to a cell. An attacker can therefore place a malicious formula in a source field and cause that formula to be preserved as active spreadsheet content in the generated report.Depending on the spreadsheet application and its security configuration, malicious formulas can create deceptive hyperlinks, initiate requests to attacker-controlled resources, reference local or external workbooks, or attempt to disclose data available to the user opening the report. Exploitation ultimately depends on the report being opened in a spreadsheet applic ...[truncated 1610 chars]
- Remediation
View remediation
Remediation Suggestions
Implement a centralized function that neutralizes untrusted spreadsheet text before assigning it to a cell:
python def sanitize_excel_text(value): if value is None: return '' value = str(value) if value.startswith(('=', '+', '-', '@')): return "'" + value return valueApply this function to every textual value originating from an input Excel file or replaceable JSON file:
python ws3[f'D{row}'] = sanitize_excel_text(province) ws3[f'E{row}'] = sanitize_excel_text(city) ws3[f'F{row}'] = sanitize_excel_text(district)Additional hardening measures should include:
- Validate province, city, and district fields against an expected character policy or trusted geographic dataset.
- Sanitize every untrusted string written to every worksheet, not only the three identified fields.
- Reject formula-prefixed values when formulas are never legitimate input.
- Add automated tests confirming that a source value beginning with
=is stored as literal text rather than as a formula. - Treat replaceable route and distribution JSON files as untrusted because their warehouse and geographic names are also written into reports.