T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:1571- Finding
Spreadsheet Formula Injection in CSV and Excel Exports
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 1571-1652
Vulnerability Type: Spreadsheet formula injection
Risk Level: MediumVulnerable Code
python def export_to_csv(self, results: List[ValuationResult]) -> str: """Export as CSV.""" import csv import io output = io.StringIO() writer = csv.writer(output) headers = ['Code', 'Name', 'Type', 'Price', 'Change %', 'PE', 'PE Percentile', 'PE Warning', 'PB', 'PB Percentile', 'PB Warning', 'ROE %', 'ROE Rating', 'Valuation Zone', 'Suggestion', 'Data Source', 'Timestamp'] writer.writerow(headers) for r in results: if not r.success or not r.basic_info: writer.writerow([r.code, '', '', '', '', '', '', '', '', '', '', '', '', r.message, '', '']) continue bi = r.basic_info pe_warning = r.pe.warning if r.pe else '' pb_warning = r.pb.warning if r.pb else '' writer.writerow([ r.code, bi.name or '', 'ETF' if r.asset_type == AssetType.ETF else 'Stock', bi.price if bi.price else '', bi.change_pct if bi.change_pct is not None else '', r.pe.current if r.pe else '', r.pe.percentile if r.pe else '', pe_warning, r.pb.current if r.pb else '', r.pb.percentile if r.pb else '', pb_warning, r.roe['current'] if r.roe else '', r.roe['level'] if r.roe else '', r.zone, r.suggestion, ','.join(r.data_sources), r.timestamp ])python def export_to_excel(self, results: List[ValuationResult]) -> Optional[bytes]: if not EXCEL_AVAILABLE: return None import io output = io.BytesIO() data = [] for r in results: if not r.success or not r.basic_ ...[truncated 3326 chars]- Remediation
View remediation
Remediation Suggestions
- Apply a centralized spreadsheet-sanitization function to every externally influenced string before CSV or Excel serialization.
- Treat values beginning with
=,+,-,@, tab, carriage return, or line feed as unsafe. - Prefix unsafe values with an apostrophe or otherwise force the destination cell to use an explicit text data type.
- Apply sanitization to all text fields, not only the stock name, so later changes do not introduce another unsafe export path.
- For XLSX output, explicitly configure external values as text cells rather than relying only on string transformation.
- Add regression tests for values such as
=HYPERLINK(...),+cmd,-1+1,@SUM(...), tab-prefixed formulas, and carriage-return-prefixed formulas. - Document that exported files contain externally sourced information and should be opened with external links and legacy formula features disabled.