T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils.js:19- Finding
CSV Formula Injection Through Azure DevOps Work Item Fields
- Content
View full analysis
{ const text = value == null ? '' : String(value); if (/[",\n]/.test(text)) return '"' + text.replace(/"/g, '""') + '"'; return text; }; ``` The affected data originates from Azure DevOps fields normalized without spreadsheet-specific sanitization in `scripts/workitems.js:26-45`: ```javascript function normalizeWorkItem(item) { const fields = item.fields || {}; const assigned = assignedToParts(fields['System.AssignedTo']); return { id: item.id, title: fields['System.Title'] || '', state: fields['System.State'] || '', type: fields['System.WorkItemType'] || '', assignedTo: assigned.assignedTo, assignedToEmail: assigned.assignedToEmail, project: fields['System.TeamProject'] || '', iterationPath: fields['System.IterationPath'] || '', areaPath: fields['System.AreaPath'] || '', priority: fields['Microsoft.VSTS.Common.Priority'] ?? '', createdDate: fields['System.CreatedDate'] || '', changedDate: fields['System.ChangedDate'] || '', closedDate: fields['Microsoft.VSTS.Common.ClosedDate'] || '', originalEstimate: fields['Microsoft.VSTS.Scheduling.OriginalEstimate'] ?? '', remainingWork: fields['Microsoft.VSTS.Scheduling.RemainingWork'] ?? '', storyPoints: fields['Microsoft.VSTS.Scheduling.StoryPoints'] ?? '', }; } ``` ### Technical Analysis The CSV encoder escapes commas, quotation marks, and newlines, but it does not neutralize strings beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@`. Tab and carriage-return prefixes can also be used to bypass simplistic filtering in some spreadsheet applications. Fields such as work-item titles, assignee names, p ...[truncated 1331 chars]- Remediation
View remediation
{ const text = neutralizeSpreadsheetValue(value); return /[",\n]/.test(text) ? '"' + text.replace(/"/g, '""') + '"' : text; }; ``` ]]>