T09 · Insecure Skill Coding Practices
Error
- Location
lucid_skill/connectors/csv_conn.py:27- Finding
SQL Injection Through CSV and Excel Path Parameters
- Content
View full analysis
None: csv_path = os.path.abspath(config["path"]) self.source_id = f"csv:{os.path.basename(csv_path)}" self._db = duckdb.connect(":memory:") if os.path.isdir(csv_path): files = [f for f in os.listdir(csv_path) if f.endswith(".csv")] for file in files: name = _sanitize_name(os.path.splitext(file)[0]) file_path = os.path.join(csv_path, file) self._db.execute( f'CREATE TABLE "{name}" AS SELECT * FROM read_csv_auto(\'{file_path}\')' ) self._tables.append(name) self._table_files[name] = file_path else: name = _sanitize_name(os.path.splitext(os.path.basename(csv_path))[0]) self._db.execute( f'CREATE TABLE "{name}" AS SELECT * FROM read_csv_auto(\'{csv_path}\')' ) ``` ```python # lucid_skill/connectors/csv_conn.py:70-74 def register_to_duckdb(self, db) -> list[str]: for table_name, file_path in self._table_files.items(): db.execute( f'CREATE OR REPLACE TABLE "{table_name}" AS SELECT * FROM read_csv_auto(\'{file_path}\')' ) return list(self._tables) ``` ```python # lucid_skill/connectors/excel_conn.py:28-48 def connect(self, config: dict) -> None: self._file_path = os.path.abspath(config["path"]) file_name = os.path.splitext(os.path.basename(self._file_path))[0] self.source_id = f"excel:{file_name}" self._db = duckdb.connect(":memory:") self._db.execute("INSTALL spatial; LOAD spatial;") sheets = config.get("sheets") if sheets and len(sheets) > 0: for sheet in s ...[truncated 2972 chars]- Remediation
View remediation