T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:55- Finding
Unsafe JSON and CSV Export of Attacker-Controlled Log Values
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` ### Technical Analysis The export implementation directly interpolates log contents into JSON and CSV without format-specific encoding. For JSON, characters such as double quotes, backslashes, control characters, and embedded newlines are not escaped. A crafted value can terminate the intended JSON string, inject additional properties or records, or make the entire document invalid. For CSV, fields containing commas, double quotes, carriage returns, or newlines are not quoted according to CSV rules. In addition, values beginning with spreadsheet formula markers such as `=`, `+`, `-`, or `@` are written unchanged. If such an export is opened in spreadsheet software, the value may be interpreted as a formula rather than inert text. The affected values originate from local log files populated with user-provided command arguments. Although the current action-command implementation has a separate top-level `local` correctness defect that may prevent normal recording, existing, manually created, or externally populated log files remain exploitable. ### ...[truncated 1513 chars]- Remediation
View remediation