T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:62- Finding
Unescaped User-Controlled Data Produces Unsafe JSON and CSV Exports
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` The exported `val` field originates from command-line input stored directly in category logs. For example, the `configure` command writes the supplied value without normalization or validation: ```bash local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/configure.log" ``` ### Technical Analysis JSON output is constructed through string interpolation without escaping quotation marks, backslashes, control characters, or embedded line breaks. A value containing JSON syntax can therefore corrupt the document or inject additional properties or records into the generated export. CSV output is similarly generated without RFC 4180 quoting. Commas, quotation marks, and line breaks in a stored value can alter the apparent columns or inject additional rows. In addition, a value beginning with `=`, `+`, `-`, or `@` can be interpreted as a formula when the CSV is opened by spreadsheet software. Depending on the spreadsheet application and its security settings, a malicious formula may initiate external requests, expose spreadsheet dat ...[truncated 1693 chars]- Remediation
View remediation