T09 · Insecure Skill Coding Practices
Error
- Location
scripts/write_expense.sh:60- Finding
<![CDATA[Spreadsheet Formula Injection Through User-Controlled Transaction Fields]]>
- Content
View full analysis
/dev/null ``` The same pattern is present in the income writer: ```bash BODY=$(jq -n \ --arg tid "$TRANSACTION_ID" \ --arg dt "$FORMATTED_DATE" \ --argjson amt "$AMOUNT" \ --arg name "$NAME" \ --arg acc "$ACCOUNT" \ --arg src "$SOURCE" \ --arg notes "$NOTES" \ '{"values": [[($tid), ($dt), ($amt), ($name), ($acc), ($src), ($notes)]]}') RESULT=$(curl -sf -X POST \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ "https://sheets.googleapis.com/v4/spreadsheets/${SPREADSHEET_ID}/values/Income%21D5%3AJ:append?valueInputOption=USER_ENTERED&insertDataOption=OVERWRITE" \ -d "$BODY") ``` ### Technical Analysis The scripts insert user-controlled descriptions, names, accounts, notes, sources, and other free-text fields using Google Sheets' `USER_ENTERED` input mode. This mode parses values as if they were typed through the spreadsheet interface, including interpreting strings beginning with formula syntax as formulas. The category cell intentionally requires formula behavior because the template uses values such as `=zategory4`. However ...[truncated 2030 chars]- Remediation
View remediation