T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:10- Finding
Unescaped JSON Storage and CSV Formula Injection
- Content
View full analysis
> "$DATA_DIR/data.jsonl" } ``` ```bash csv) echo "timestamp,command,value" > "$out" while IFS= read -r line; do ts=$(echo "$line" | grep -o '"ts":"[^"]*' | cut -d'"' -f4) c2=$(echo "$line" | grep -o '"cmd":"[^"]*' | cut -d'"' -f4) vl=$(echo "$line" | grep -o '"val":"[^"]*' | cut -d'"' -f4) echo "$ts,$c2,$vl" >> "$out" done < "$DATA_DIR/data.jsonl" ;; ``` ### Technical Analysis The `add` command ultimately passes user-controlled text to `_save_entry`. The value is interpolated directly into a JSON string without escaping quotation marks, backslashes, line breaks, or other JSON control characters. An attacker can therefore terminate the intended JSON string, introduce additional properties, or inject new lines that appear to be independent records. The later `list`, `search`, and `export` operations parse records using regular expressions rather than a JSON parser, making malformed or forged records more likely to be accepted incorrectly. The CSV export has a second output-encoding issue. Fields are concatenated with commas without RFC 4180 quoting or escaping. Values containing commas, quotation marks, or line breaks can alter the CSV structure. Values beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` are not neutralized. When the result is opened in spreadsheet software, such values may be evaluated as formulas. ### Attack Path 1. The attacker supplies a crafted entry through the public command interface, ...[truncated 1166 chars]- Remediation
View remediation
> "$DATA_DIR/data.jsonl" ``` 2. Parse stored records with `jq` rather than `grep` and `cut`: ```bash jq -r '[.ts, .cmd, .val] | @tsv' "$DATA_DIR/data.jsonl" ``` 3. Generate CSV through a serializer that implements correct field quoting: ```bash jq -r '[.ts, .cmd, .val] | @csv' "$DATA_DIR/data.jsonl" ``` 4. Before spreadsheet export, neutralize values beginning with `=`, `+`, `-`, or `@`, for example by prefixing them with a single quote where compatible with the target spreadsheet application. 5. Reject or safely encode embedded control characters if multiline entries are not an intended feature. 6. Add regression tests covering quotation marks, backslashes, commas, CR/LF characters, malformed JSON fragments, and spreadsheet-formula prefixes. ]]>