T09 · Insecure Skill Coding Practices
Warning
- Location
report.js:4- Finding
Spreadsheet Formula Injection Through Unsanitized Scraped Values
- Content
View full analysis
{ const line = headers.map(h => { const v = r[h] === undefined ? '' : String(r[h]).replace(/"/g, '""'); return `"${v}"`; }).join(','); lines.push(line); }); return lines.join('\n'); } ``` ```javascript function rowsToSheetValues(rows, headers, aliases) { return rows.map(row => { const lookup = buildLookup(row); return headers.map(header => valueForHeader(lookup, header, aliases)); }); } async function appendValues(spreadsheetToken, range, values, token) { const { data } = await axios.post( `${FEISHU_BASE_URL}/sheets/v2/spreadsheets/${spreadsheetToken}/values_append`, { valueRange: { range, values } }, { ...FEISHU_REQUEST, headers: feishuHeaders(token) } ); if (data.code !== 0) { throw new Error(`写入飞书表格失败: ${data.msg || data.code}`); } return data.data || {}; } ``` ### Technical Analysis Values collected from the remote Ocean Engine table are treated as trusted spreadsheet content. The CSV exporter escapes double quotes but does not neutralize fields beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@`. Enclosing such a value in double quotes does not prevent spreadsheet applications from interpreting it as a formula. The Feishu export path similarly maps scraped values directly into the API request without distinguishing text from formulas or applying formula-prefix validation. If the destination spreadsheet interprets submitted strings as formulas, an attacker-controlled table value can become active spreadsheet content. Exploitation depends on an att ...[truncated 1259 chars]- Remediation
View remediation