T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:217- Finding
Spreadsheet Formula Injection in Exported Excel and CSV Files
- Content
View full analysis
1_000_000: csv_path = output_path.rsplit('.', 1)[0] + '.csv' df.to_csv(csv_path, index=False) print(f"Over 1M rows — exported as CSV: {csv_path}") return csv_path if total_cells > 50_000: from openpyxl import Workbook from openpyxl.cell import WriteOnlyCell wb = Workbook(write_only=True) ws = wb.create_sheet(title=sheet_name) ws.append(list(df.columns)) for idx, row in enumerate(df.itertuples(index=False)): ws.append([None if pd.isna(v) else v for v in row]) if (idx + 1) % 100_000 == 0: print(f" Written {idx + 1:,} rows...") wb.save(output_path) wb.close() print(f"write_only mode: {len(df):,} rows -> {output_path}") else: df.to_excel(output_path, index=False, sheet_name=sheet_name) print(f"Standard write: {len(df):,} rows -> {output_path}") return output_path ``` ### Technical Analysis The export function writes DataFrame column names and values directly into CSV or XLSX output without sanitizing untrusted strings that begin with spreadsheet formula indicators such as `=`, `+`, `-`, or `@`. The issue affects all three export paths: - `df.to_csv(...)` writes formula-like values directly into CSV fields. - `ws.append(...)` passes values directly to `openpyxl`, which can treat strings beginning with `=` as formulas. - `df.to_excel(...)` can produce formula cells when formula-like strings are passed through an Excel writer. - `ws.append(list(df.columns))` also leave ...[truncated 2392 chars]- Remediation
View remediation