Re:Dangers of CSV Injection
by efreak on Tuesday October 10, 2017 @07:13PM
(#15446065)
You would think so, but people are dumb. I've seen tab-delimited files that are .CSV instead of .tsv, and I've also seen the semicolon delimiter a few times though I can't recall where. I think Excel actually pops up a prompt when importing to confirm the delimiter in some cases?
From your link, it's quite clear that you should not assume any particular CSV file to follow any particular rules.
> Interoperability considerations:
> Due to lack of a single specification, there are considerable differences among implementations. Implementors should "be conservative in what you do, be liberal in what you accept from others" (RFC 793 [8]) when processing CSV files. An attempt at a common definition can be found in Section 2....
> Published specification:
> While numerous private specifications exist for various programs and systems, there is no single "master" specification for this format. An attempt at a common definition can be found in Section 2.
Section 2 states:
> This section documents the format that seems to be followed by most implementations:
From your link, it's quite clear that you should not assume any particular CSV file to follow any particular rules.
> Interoperability considerations: > Due to lack of a single specification, there are considerable differences among implementations. Implementors should "be conservative in what you do, be liberal in what you accept from others" (RFC 793 [8]) when processing CSV files. An attempt at a common definition can be found in Section 2....
> Published specification: > While numerous private specifications exist for various programs and systems, there is no single "master" specification for this format. An attempt at a common definition can be found in Section 2.
Section 2 states:
> This section documents the format that seems to be followed by most implementations: