T09 · Insecure Skill Coding Practices
Error
- Location
tools/employee_manager.py:650- Finding
Spreadsheet Formula Injection Through Employee Fields
- Content
View full analysis
Tuple[bool, str]: # Validation isValid, errors = emp.validate() if not isValid: return False, f"Employee validation failed: {'; '.join(errors)}" # Check employee-number uniqueness if emp.empNo in self.employees: return False, f"Employee number already exists: {emp.empNo}" if not emp.status: emp.status = "probation" emp._isNew = True self.employees[emp.empNo] = emp ``` ### Technical Analysis Employee properties are passed directly to `openpyxl` worksheet cells. A string beginning with `=` is interpreted as a formula rather than ordinary text. Other spreadsheet clients may also interpret strings beginning with `+`, `-`, or `@` as formulas or formula-like expressions. The employee validation routine checks required values and selected phone, email, identity-card, and date formats. It does not sanitize free-form fields such as employee name, department, position, rep ...[truncated 1680 chars]- Remediation
View remediation