News for hackers. Stuff that matters.
Re:Dangers of CSV Injection by benmmurphy on Tuesday October 10, 2017 @07:42AM (#15440958)
i don't know why spreadsheet applications don't standardise on a file extension that they won't screw with. call it csf or something. treat it like pure CSV except don't interpret =/@ or any of the other weirdness. basically just interpret all fields as plain strings as default [even if they look like numbers]. this way everything is backwards compatible old 'weird CSV' files still work and those that care about their users can use .csf and the files won't endanger their users.
Re:Dangers of CSV Injection by mulmen on Tuesday October 10, 2017 @08:01AM (#15441051)
Yeah or they could just make "mangle my CSV files" an option buried in the config somewhere. I'd even open up regedit.
Re:Dangers of CSV Injection by mark-r on Tuesday October 10, 2017 @10:30AM (#15442066)
That would make safety an "opt in" measure, it should be "opt out" instead. Make the CSV format stop interpreting formulas unless you specifically ask it to. Most people don't put formulas in their CSV files anyway.
Re:Dangers of CSV Injection by mulmen on Tuesday October 10, 2017 @01:18PM (#15443539)
The CSV format doesn't interpret anything, it's spreadsheet applications doing that.
Re:Dangers of CSV Injection by mark-r on Tuesday October 10, 2017 @02:13PM (#15444013)
Sorry if I was unclear, that was exactly what I meant - applications that open CSV files.