Core Contracts

Summary

Vulnerability DetailsCSV Injection Vulnerability:

Description: When generating the CSV file, input data (like filenames or numeric values) is not sanitized.

Risks:

If a filename contains special characters like , or \n, the CSV format will break.

If a filename includes malicious formulas like =cmd|' /C calc'!A0, they will execute automatically when opened in programs like Excel (DDE attack).

Example of CSV Injection .

// If a filename contains a malicious formula:
const maliciousFileName = "=HYPERLINK('')";
// The CSV row becomes:
// =HYPERLINK(',...
// When opened in Excel, this formula will execute! .

Root Cause in the Code:

The generateCSV function directly appends data without sanitization:.

// Vulnerable code:
const stats = statKeys.map(key => result.stats[key]);
return [result.file, ...stats].join(','); // Problem here!.

Proposed Fix:

• Sanitize Data: Use a library like csv-stringify or manually escape values

• const sanitizeValue = (value) => {

• if (typeof value === 'string' && /^[=+\-@]/.test(value)) {

• return `\t${value}`;

• }

• return value;

• };

• . Other Potential Weaknesses:

• Path Traversal:

If directoryPath comes from user input without validation, it could allow access to files outside the intended directory.

analyzeDirectory('../../etc/passwd'); // Risk if path is not validated!.

Recommendations:

1. Sanitize CSV Data: Implement the fixes above to prevent injection attacks.

2. Validate Paths: Use path.resolve to ensure paths stay within allowed directories.

3. Use Asynchronous Methods: Replace synchronous functions with readFile/readdir for better performance.

Example Fix Implementation:

// In the generateCSV function:
const escapeCSV = (value) => {
if (typeof value === 'string') {
if (/^[=+-@]/.test(value)) {
value = \t${value}; // Neutralize dangerous formulas
}
return "${value.replace(/"/g, '""')}"; // Escape quotes
}
return value;
};

// Modify row creation:
const stats = statKeys.map(key => escapeCSV(result.stats[key]));
return [escapeCSV(result.file), ...stats].join(',');

Impact

Tools Used

Recommendations