T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:63- Finding
Unescaped User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` The relevant unsafe output operations are at lines 68 and 80. ### Technical Analysis Arguments supplied to commands such as `check`, `generate`, and `report` are stored without normalization in log files under `~/.local/share/changelog/`. The export function subsequently inserts those stored values directly into JSON and CSV output. For JSON output, the script uses string interpolation without escaping quotation marks, backslashes, control characters, or line breaks. A value containing JSON syntax can terminate the intended string and inject additional properties or objects, or simply produce invalid JSON. Downstream programs may reject the export or process attacker-injected structure as trusted data. For CSV output, fields are concatenated with commas without RFC 4180 quoting. Commas, quotation marks, carriage returns, and line feeds can alter the row or column structure. In addition, values beginning with charact ...[truncated 1589 chars]- Remediation
View remediation