T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/review_engineering_doc.py:501- Finding
Untrusted document values can trigger spreadsheet formula injection
- Content
View full analysis
None: if Workbook is None: raise RuntimeError( "生成 Excel 需要 openpyxl。请运行：python -m pip install openpyxl" ) wb = Workbook() ws = wb.active ws.title = "字段" ws.append(["分组", "字段", "值"]) def append_group(prefix: str, value: Any) -> None: if isinstance(value, dict): for key, child in value.items(): append_group(f"{prefix}.{key}" if prefix else key, child) elif isinstance(value, list): ws.append([prefix, "", json.dumps(value, ensure_ascii=False)]) else: group, _, key = prefix.rpartition(".") ws.append([group, key or prefix, value]) ``` ### Technical Analysis The application extracts values from untrusted DOCX, PDF, XLSX, and XLSM documents and writes those values directly into a generated Excel workbook. The scalar `value` passed to `ws.append()` is not validated or escaped. Spreadsheet applications can interpret strings beginning with `=`, `+`, `-`, or `@` as formulas. An attacker who controls an input document can therefore place a formula-prefixed payload in a field that the parser extracts. The resulting `fields.xlsx` workbook will contain the attacker-controlled formula rather than an inert text value. The payload is not evaluated by the Python parser itself. Exploitation occurs when a reviewer opens the generated workbook in a spreadsheet application, and the precise behavior depends on that application's formula support and security settings. ### Attack Path 1. An attacker supplies an engineering document containing a value such as a project name or other recognized field that begins with a spreadsheet formula character. 2. The parser reads that value and st ...[truncated 1159 chars]- Remediation
View remediation
Any: if not isinstance(value, str): return value dangerous = value.lstrip().startswith(("=", "+", "-", "@")) return "'" + value if dangerous else value # Apply to all untrusted values written to cells. ws.append([ safe_excel_text(group), safe_excel_text(key or prefix), safe_excel_text(value), ]) ``` For stronger guarantees, create cells explicitly and set their data type to text after sanitization. ]]>