4 ms·
Does xlsx suffer from the same vulnerabilities? What are the downsides of using it for ~everything?
by rattray 9y ago
Does xlsx suffer from the same vulnerabilities?
What are the downsides of using it for ~everything?
- rattray 9y agoI went looking for a simple parser example. Sheetjs's "complete" implementation is 18k loc: https://github.com/SheetJS/js-xlsx/blob/master/xlsx.js https://github.com/SheetJS/js-xlsx/blob/master/xlsx.js But at least the work has been done for me. A rather more manageable read can be found at https://github.com/woahdae/simple_xlsx_reader/blob/master/lib/simple_xlsx_reader.rb https://github.com/woahdae/simple_xlsx_reader/blob/master/li... which seems to illuminate the basics of the xlsx format in exactly the way I was hoping.
- bradleyjg 9y agoIf you are opening up the resulting file in excel, yes. If you are writing your own minimal XLSX parser like geocar say he has, probably not. It's unlikely that your own parser is going to implement the functionality to go send an arbitrary AJAX request.
- geocar 9y agoYou mean does Google Sheets suffer from the same vulnerabilities? IMPORTXML is a Google Sheets function and isn't in Excel. My php-based xlsx parser is about 100 lines. If you don't need time series you can save almost twenty lines. Strings cost about ten lines. Even still, whilst it may not support every string-type or every time format, it is more reliable than any CSV parser...