4 ms·

I was hoping to see some mention of the security downsides of CSVs - something that as a programmer of over 10 years experience, I wasn't aware of until a coupl

I was hoping to see some mention of the security downsides of CSVs - something that as a programmer of over 10 years experience, I wasn't aware of until a couple of years ago. If you hand a CSV to a normal person, they'll open it in MS Office. Or LibreOffice. If you put a formula into any cell starting with an `=` character, the office suite will give you a terse warning about updates or something, and when you accept, it will run every formula. For example, you could write a formula to convert cells A1:D10 to params, and make a GET request to an address on your personal server. If the CSV contains user submitted data, e.g. if someone has set that formula as their name, and the CSV hasn't been carefully sanitised, then hand someone from the business your CSV to build some sort of report, they may well be sending much of the data to a 3rd party. While maybe not a CSV-specific issue, certainly CSVs are believed to be safe (it's just a text file! We're only using it internally!) They really are not safe, and it sometimes takes a non-trivial amount of work to make them safe.

fctorial 6y ago
This is a bug in spreadsheet csv import functionality.
- undecisive 6y ago
  In that it's undesirable behaviour, yes. Certainly the messaging could be a lot clearer. But the fact that multiple office suites do the same thing... one could argue that there are good reasons for allowing formulae in CSV files. So I would argue that the "bug" is never going to be fixed, and that the real fix has to be our attitudes. We need to start treating CSVs the same way as we treat HTML - sanitise any user-provided strings strongly, quote all fields, etc.
masklinn 6y ago
> If you put a formula into any cell starting with an `=` character, the office suite will give you a terse warning about updates or something, and when you accept, it will run every formula. Also Excel use the prefix apostrophe (') as an escape character to force text interpretation of a cell. It will save that escape character to CSV, and will interpret an apostrophe prefix as an escape character.
- undecisive 6y ago
  Yep. There are a bunch of gotchas that don't necessarily present security issues, but can be annoying to debug. Another good example is we used to generate random strings and report on those, but sometimes we got weird numbers appear in the fields, or ###, or even 0. Turned out that the random string generator would sometime produce strings like '327e-733" which excel helpfully parses for us.

fctorial 6y ago

This is a bug in spreadsheet csv import functionality.

undecisive 6y ago
In that it's undesirable behaviour, yes. Certainly the messaging could be a lot clearer. But the fact that multiple office suites do the same thing... one could argue that there are good reasons for allowing formulae in CSV files. So I would argue that the "bug" is never going to be fixed, and that the real fix has to be our attitudes. We need to start treating CSVs the same way as we treat HTML - sanitise any user-provided strings strongly, quote all fields, etc.

masklinn 6y ago

> If you put a formula into any cell starting with an `=` character, the office suite will give you a terse warning about updates or something, and when you accept, it will run every formula. Also Excel use the prefix apostrophe (') as an escape character to force text interpretation of a cell. It will save that escape character to CSV, and will interpret an apostrophe prefix as an escape character.

undecisive 6y ago
Yep. There are a bunch of gotchas that don't necessarily present security issues, but can be annoying to debug. Another good example is we used to generate random strings and report on those, but sometimes we got weird numbers appear in the fields, or ###, or even 0. Turned out that the random string generator would sometime produce strings like '327e-733" which excel helpfully parses for us.