T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:66- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" ``` ```bash while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" ``` ### Technical Analysis The export implementation directly interpolates values read from campaign log files into JSON and CSV output without format-aware encoding. For JSON exports, characters such as double quotes, backslashes, control characters, and embedded newlines are not escaped. A crafted value can therefore produce malformed JSON or inject additional JSON properties or objects into the exported document. For CSV exports, commas, double quotes, carriage returns, and newlines are not escaped according to CSV serialization rules. In addition, cells beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` are written unchanged. If an exported file is opened in formula-capable spreadsheet software, attacker-controlled content may be interpreted as a formula rather than inert text. Quoting shell variables prevents shell word splitting but does not provide JSON or CSV encoding. Dedicated serializers are required for each output format. ### Attack Path 1. An attacker convinces a user to store crafted content through a command such as `campaign draft `, or otherwise causes crafted content to be present in one of the campaign log files. 2. The crafted content is persisted as the `value` portion of a log entry. 3. The user executes `campaign export json` or `campaign export csv`. 4. The export function copies the attacker-controlled value into the destination document without escaping it. 5. For JSON, the attacker can corrupt the document structu ...[truncated 1048 chars]- Remediation
View remediation