T09 · Insecure Skill Coding Practices
Warning
- Location
generator.py:493- Finding
Spreadsheet Formula Injection in CSV Exports
- Content
View full analysis
List[Dict]: """解析 CSV 输入，返回产品字典列表""" reader = csv.DictReader(io.StringIO(csv_text.strip())) products = [] for row in reader: products.append({ "product_name": row.get("product_name") or row.get("产品名称") or "", "category": row.get("category") or row.get("类目") or "", "keywords": row.get("keywords") or row.get("关键词") or "", "brand": row.get("brand") or row.get("品牌") or "", "price": row.get("price") or row.get("价格") or "", }) return [p for p in products if p["product_name"]] ``` ### Technical Analysis The application accepts arbitrary product data from an imported CSV and writes that data back into generated CSV output. The standard `csv.writer` correctly quotes CSV syntax but does not prevent spreadsheet applications from interpreting a cell as a formula. A product name beginning with `=`, `+`, `-`, or `@` can therefore remain executable spreadsheet content. Leading tabs, carriage returns, or whitespace may also be used to bypass simplistic prefix checks in some spreadsheet applications. For example, a malicious input product name could contain a formula that initiates an external request when the generated file is opened. The generated description and title fields also incorpo ...[truncated 1510 chars]- Remediation
View remediation
str: text = str(value) normalized = text.lstrip(" \t\r\n") if normalized.startswith(("=", "+", "-", "@")): return "'" + text return text ``` Apply it to each exported value: ```python writer.writerows( [[neutralize_csv_cell(cell) for cell in row] for row in rows] ) ``` ]]>