T09 · Insecure Skill Coding Practices
- Location
scripts/generate_cost_report.py:26- Finding
Excel Formula Injection Through Untrusted Text Fields
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_cost_report.py, lines 26–28 and 198–199
Vulnerability Type: Excel formula injection
Risk Level: MediumVulnerable Code
python customers = [str(df.iloc[i]['客户大类']) if pd.notna(df.iloc[i]['客户大类']) else '' for i in range(len(df))] projects = [str(df.iloc[i]['项目大类']) if pd.notna(df.iloc[i]['项目大类']) else '' for i in range(len(df))] order_ids = [str(df.iloc[i]['内部订单号']) if pd.notna(df.iloc[i]['内部订单号']) else '' for i in range(len(df))]python for c, val in enumerate([customers[idx], projects[idx], order_ids[idx]], 1): cell = ws.cell(row=row, column=c, value=val)Technical Analysis
The Skill reads the customer category, project category, and internal order identifier from an untrusted source workbook and writes those values directly into a generated Excel workbook. It does not validate or neutralize spreadsheet formula prefixes.
When
openpyxlreceives a string beginning with=, it can store that value as a formula cell rather than inert text. Other spreadsheet-sensitive prefixes, including+,-,@, tab, and carriage return, may also require neutralization because their interpretation varies across spreadsheet applications and import workflows.Although the customer category is constrained to four accepted values before output, the corresponding project category and internal order identifier remain attacker-controlled. A malicious source workbook can therefore place formula content in either of those fields and preserve it in the generated report.
Attack Path
- An attacker prepares a source workbook with an accepted customer category such as
BAT. - The attacker places a malicious formula-like value in the same row's project category or internal order identifier.
- A user invokes the Skill with that workbook.
- The script reads the value and converts it to a Python string without validation.
- The value is passed directly to
openpyxlas the out ...[truncated 968 chars]
- An attacker prepares a source workbook with an accepted customer category such as
- Remediation
View remediation
Remediation Suggestions
Treat every text value copied from an input workbook as untrusted spreadsheet content.
- Create a centralized sanitization function that neutralizes values beginning with
=,+,-,@, tab, or carriage return. - Prefix dangerous values with an apostrophe or otherwise encode them as literal text according to the target spreadsheet application's requirements.
- Explicitly set sanitized cells to the string data type where appropriate.
- Apply sanitization to all source-derived text fields, not only the currently identified columns.
- Preserve the original value only if it passes a strict allowlist suitable for that field. For example, internal order identifiers can be restricted to expected letters, digits, spaces, underscores, and hyphens.
- Add regression tests covering every dangerous prefix and values containing leading whitespace before a formula marker.
- Document that source workbooks are untrusted input and that generated reports must not retain formulas from source text fields.
Example hardening pattern:
python def sanitize_excel_text(value): text = '' if value is None else str(value) dangerous_prefixes = ('=', '+', '-', '@', '\t', '\r') if text.startswith(dangerous_prefixes): return "'" + text return text for c, val in enumerate([customers[idx], projects[idx], order_ids[idx]], 1): cell = ws.cell(row=row, column=c, value=sanitize_excel_text(val)) cell.data_type = 's'Field-specific allowlist validation should be preferred where the expected data format is known.
- Create a centralized sanitization function that neutralizes values beginning with