T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:78
- Finding
- CSV Formula Injection in Exported Data## Vulnerability Details **File Location**: `scripts/script.sh`, lines 78–86 **Vulnerability Type**: CSV formula injection and improper CSV escaping **Risk Level**: Medium ### Vulnerable Code ```bash csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` ### Technical Analysis The `val` variable contains user-controlled content read from local log files. It is written directly to a CSV file without CSV field quoting, escaping, or spreadsheet-formula neutralization. If a stored value begins with a spreadsheet formula prefix such as `=`, `+`, `-`, or `@`, spreadsheet applications may interpret it as a formula when `export.csv` is opened. Embedded commas, double quotes, carriage returns, or newlines can also corrupt the CSV structure and permit field or row manipulation. The shell does not execute the value; exploitation occurs in downstream spreadsheet software that interprets the generated file. ### Attack Path 1. An attacker persuades a user or automated workflow to store attacker-controlled content through a content command, for example: ```bash trend draft '=HYPERLINK("https://attacker.invalid","Open report")' ``` 2. The application stores the value in a command log under `~/.local/share/trend/`. 3. The user runs: ```bash trend export csv ``` 4. The exporter copies the value verbatim into `~/.local/share/trend/export.csv`. 5. The user opens the CSV in spreadsheet software. 6. If that software evaluates CSV fields as formulas, the injected expression may be activated or presented as an actionable formula. ### Impact Assessment This vulnerability does not directly grant shell privileges or execute commands within the audited script. Its scope is the account and spreadsheet environment of a user who opens the generated ...[truncated 618 chars]
- Remediation
- ## Remediation Suggestions 1. Generate CSV through a dedicated serializer rather than string concatenation. 2. Enclose every field in double quotes and replace each embedded double quote with two double quotes. 3. Correctly preserve embedded commas, carriage returns, and newlines. 4. Before serialization, neutralize values whose first non-whitespace character is `=`, `+`, `-`, or `@`. A common defensive option is to prefix such values with a single quote, subject to compatibility requirements. 5. Apply the same escaping rules to every field, including `name`, `ts`, and `val`. 6. Add tests covering formula prefixes, commas, quotes, CRLF characters, and multiline values. 7. Document that exported files can contain untrusted user input and should not be opened with formula execution enabled. A safe implementation should use a trusted CSV-capable utility or language library. If Bash must be retained, implement and consistently apply a function that performs standards-compliant field quoting and formula neutralization.