News for hackers. Stuff that matters.
Re:Dangers of CSV Injection by pc86 on Tuesday October 10, 2017 @10:40AM (#15442165)
I used to work in third-party logistics and a big project of mine was an automated file import process, so folks could send us their daily/hourly orders for processing and fulfillment. I'd say roughly 65-70% of the entire code base was error handling and figuring out when to kick out a file for human review and/or outright deny it and contact the customer.

The hardest ones to work with were the mom and pop shops who suddenly had some success on Amazon and came to us after fulfilling out of their garage for a year and a half. Try telling a semi-retired 60 year old electrician in the middle of Iowa that the file he sent is worthless because none of the product codes match what you have, especially when once he closes the file he doesn't have any idea where it is.

Re:Dangers of CSV Injection by mratzloff on Tuesday October 10, 2017 @11:08AM (#15442415)
A long time ago I did the same work with banks. The effect was the same. It was amazing to me how bank employees could somehow find a way to regularly insert ASCII control characters into a CSV value.
Re:Dangers of CSV Injection by robterrin on Tuesday October 10, 2017 @11:40AM (#15442700)
On a consulting project a few years ago, I was brought in to help a Fortune 500 energy company make sense of the value at risk model that one guy had built over 20 years in VBA. Most of it was pulling from excel spreadsheets brokers would send daily with prices. What. A. Nightmare.

It was hard to decide what I hated most about the project. The mind numbing stupidity of it. That fact that managers had allowed this single point of failure, and then let the guy leave. Or... that it was all a fictitious dance, pursued because spinning off their trading operations, would get them millions in tax subsidies.

Re:Dangers of CSV Injection by emerongi on Tuesday October 10, 2017 @12:00PM (#15442860)
I was introduced to programming by my father. He's a business analyst of sorts, so naturally he only knows VBA.

After he left his job, some poor soul had to inherit his massive collection of VBA scripts, which more or less automated his day-to-day work. I think he showed the new guy what buttons to press on his spreadsheets, but I can't imagine he understood any of the Excel-fu my father had done. The legacy architecture that is tied to Excel in all sorts of businesses.. it's crazy.

Re:Dangers of CSV Injection by pavel_lishin on Tuesday October 10, 2017 @12:29PM (#15443099)
These are the exact problems we're banging our heads against.

The worst part is that it's not something that can be solved with an external dependency on some new startup - that would just add another layer we'd have to go through in the error cases, which would be numerous.

God, I wish I could share some of the files we've received. I cannot conceive what sort of monster would write a data exporter that would produce these unreadable things.