T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/mx_self_select.py:154
- Finding
- Spreadsheet Formula Injection in Exported CSV Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mx_self_select.py:154-166` **Vulnerability Type**: CSV formula injection **Risk Level**: Medium ### Vulnerable Code ```python for stock in data_list: csv_row = {} for key, title in column_name_map.items(): csv_row[title] = stock.get(key, "") csv_rows.append(csv_row) with open(csv_path, "w", newline="", encoding="utf-8-sig") as f: writer = csv.DictWriter(f, fieldnames=fieldnames) writer.writeheader() for row in csv_rows: writer.writerow(row) ``` ### Technical Analysis Column titles and stock values received from the remote API are written directly to a CSV file without neutralizing spreadsheet formula prefixes. Python's `csv` module performs CSV syntax quoting, but it does not prevent spreadsheet applications from interpreting values beginning with `=`, `+`, `-`, or `@` as formulas. Exploitation requires an attacker to influence the API response, such as through an upstream service compromise or malicious data entering the service. When a user opens the generated file in a spreadsheet application, an injected value may be evaluated as a formula. The exact result depends on the spreadsheet product and its security configuration. ### Attack Path 1. An attacker gains control over, or otherwise influences, a column title or stock-data value returned by the configured API. 2. The attacker supplies a value beginning with a spreadsheet formula marker, such as `=`, `+`, `-`, or `@`. 3. The Skill copies that value into `mx_self_select_*.csv` without neutralization. 4. The user opens the generated CSV file in a spreadsheet application. 5. The application interprets the attacker-controlled cell as a formula. 6. Depending on the spreadsheet and enabled features, the formula may initiate an external request, expose spreadsheet data, mislead the user, or invoke other dangerous spreadsheet functionality. ### Impact Assessment The Skill itself does not directly exec ...[truncated 520 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Apply a dedicated CSV-cell neutralization function to every externally derived header and value before writing: ```python def neutralize_csv_formula(value): if value is None: return "" text = str(value) if text.startswith(("=", "+", "-", "@")): return "'" + text return text ``` Use the function for both column titles and row values. Consider handling leading whitespace, tabs, carriage returns, and other control characters that some spreadsheet products may ignore before detecting a formula. Additional hardening measures include: - Define a fixed allowlist of expected API columns instead of accepting arbitrary remote column titles. - Validate response types and reject unexpected structures. - Document that CSV files contain remote data and should be opened using protected-view settings. - Add tests covering values such as `=1+1`, `+SUM(1,1)`, `-1+2`, `@SUM(1,1)`, and formula prefixes preceded by whitespace or control characters. ]]>