Protection against CSV injection attacks

When importing a CSV file, Microsoft Excel and LibreOffice Calc will both interpret cells beginning with a = as formulae, which can lead to attacks that can result in data exfiltration or arbitrary command execution. [1] This is easily remedied by prefixing cells that begin with =, +, - or @ with a ' in order to suppress automatic interpretation of formulae by these softwares. [2]

I would like to propose an option escapeFormulae for Papa.unparse to provide this prefixing behaviour.

Thanks!

[1] https://owasp.org/www-community/attacks/CSV_Injection [2] https://www.contextis.com/en/blog/comma-separated-vulnerabilities

[asafbiton]

Hi there! 👋

My name is Asaf and I’m part of the Snyk Security Team. We have been tracking this issue for a few days now, and an advisory has been mistakenly published. I tend to agree with all the above arguments and do not believe there is a vuln within the context of papaparse.

I have therefore revoked this advisory from our database. I apologize for any inconvenience caused by this.

For further inquiries please don’t hesitate to contact us at [e-mail] or using the vulnerability disclosure form.

[mholt]

I think interpretation of the data is out of scope for a CSV parser and lends itself to more security problems, not less.