T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:63- Finding
Improper Escaping of User-Controlled Data in JSON and CSV Exports
- Content
View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ``` ### Technical Analysis The data commands store user-controlled input in log files. The export implementation subsequently inserts that data directly into JSON and CSV output without format-specific encoding. For JSON exports, quotation marks, backslashes, control characters, and embedded line breaks are not escaped. Crafted values can terminate the intended JSON string, add properties or records, or make the entire document invalid. For CSV exports, fields are neither quoted nor escaped. Commas, quotation marks, and line breaks can alter the output structure. In addition, values beginning with spreadsheet formula markers such as `=`, `+`, `-`, or `@` may be interpreted as formulas when an operator opens the exported file in spreadsheet software. Whether a formula executes automatically depends on the spreadsheet application and its security configuration. Shell command injection is not present in this code path because the variables are pass ...[truncated 1616 chars]- Remediation
View remediation