T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/export_sheet.py:59
- Finding
- CSV/TSV Formula Injection in Spreadsheet Exports## Vulnerability Details **File Location**: `scripts/export_sheet.py:59-68, 90-96` **Vulnerability Type**: CSV/TSV formula injection **Risk Level**: Medium ### Vulnerable Code ```python def select_table(payload: dict) -> list[list[str]]: """Prefer displayValues, then values.""" table = payload.get("displayValues") or payload.get("values") or [] if not isinstance(table, list): return [] normalized: list[list[str]] = [] for row in table: if isinstance(row, list): normalized.append(["" if cell is None else str(cell) for cell in row]) return normalized ``` ```python def save_table(rows: list[list[str]], output_path: Path) -> bool: """Save as a CSV or TSV file.""" try: with open(output_path, "w", encoding="utf-8-sig", newline="") as handle: writer = csv.writer(handle, delimiter=detect_delimiter(output_path)) writer.writerows(rows) return True except Exception as error: print(f"Failed to save file: {error}") return False ``` ### Technical Analysis Data obtained from remote spreadsheet cells is converted to strings and written directly to CSV or TSV without neutralizing formula-triggering prefixes. Quoting performed by `csv.writer` does not reliably prevent spreadsheet software from interpreting fields beginning with characters such as `=`, `+`, `-`, or `@` as formulas. An attacker who can modify the source DingTalk spreadsheet can therefore place a malicious formula into a cell and wait for another user to export and open the resulting file. Depending on the spreadsheet application and its security settings, formulas may initiate external network requests, disclose contextual data, present deceptive links, or invoke dangerous application-specific functionality. ### Attack Path 1. An attacker obtains legitimate or compromised write access to a DingTalk spreadsheet that the vict ...[truncated 1206 chars]
- Remediation
- ## Remediation Suggestions - Add a dedicated CSV/TSV sanitization function that detects formula-triggering prefixes. - Neutralize cells beginning with `=`, `+`, `-`, or `@` by prefixing an apostrophe or another format-safe character. - Detect dangerous prefixes after leading spaces, tabs, carriage returns, and other characters that spreadsheet applications may ignore before formula evaluation. - Apply sanitization immediately before serialization so every export path receives the same protection. - If raw formula export is required, make it an explicit opt-in option and display a clear warning before writing the file. - Add tests covering direct prefixes, whitespace-obfuscated prefixes, ordinary text, numeric values, and both CSV and TSV output.