mcp-server-semgrep/semgrep-rules/python/django/security/injection/csv-writer-injection.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: csv-writer-injection
  languages:
  - python
  message: Detected user input into a generated CSV file using the built-in `csv` module. If user data
    is used to generate the data in this file, it is possible that an attacker could inject a formula
    when the CSV is imported into a spreadsheet application that runs an attacker script, which could
    steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv`
    is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts.
    You can use `defusedcsv` instead of `csv` to safely generate CSVs.
  metadata:
    category: security
    confidence: MEDIUM
    cwe:
    - 'CWE-1236: Improper Neutralization of Formula Elements in a CSV File'
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://github.com/raphaelm/defusedcsv
    - https://owasp.org/www-community/attacks/CSV_Injection
    - https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities
    technology:
    - django
    - python
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
  mode: taint
  pattern-sinks:
  - patterns:
    - pattern-inside: |
        $WRITER = csv.writer(...)

        ...

        $WRITER.$WRITE(...)
    - pattern: $WRITER.$WRITE(...)
    - metavariable-regex:
        metavariable: $WRITE
        regex: ^(writerow|writerows|writeheader)$
  pattern-sources:
  - patterns:
    - pattern-inside: |
        def $FUNC(..., $REQUEST, ...):
          ...
    - focus-metavariable: $REQUEST
    - metavariable-pattern:
        metavariable: $REQUEST
        patterns:
        - pattern: request
        - pattern-not-inside: request.build_absolute_uri
  severity: ERROR