Re:Dangers of CSV Injection
by jandrese on Wednesday October 11, 2017 @11:22AM
(#15450481)
RFC 4180 just tried to write down what the most common quirks of CSVs were in the wild at the time. It's a reference more than a specification.
It's really a missed opportunity. Had they had the balls to actually specify CSV properly this wouldn't be nearly as much of a problem. This would have probably left a lot of the existing CSV writers non-conformant, but it would have likely improved the future situation considerably.
It doesn't even need to be complex. Just a few rules:
(basic CSV spec here)
1. Reserved characters are , " \
2. If a reserved character appears in a field, escape it with \
3. Alternatively you can double quote a field, in which case you only need to escape " characters in the field
4. Line endings are either CR, CR/LF, or LF. Parsers must suppport all line endings.
5. Character set is UTF-8, however the " , and \ characters must be 0x22, 0x2C, and 0x5C. Alternative language lookalike characters will not be treated as control characters.
6. Whitespace adjacent to a comma is ignored by the parser
It's really a missed opportunity. Had they had the balls to actually specify CSV properly this wouldn't be nearly as much of a problem. This would have probably left a lot of the existing CSV writers non-conformant, but it would have likely improved the future situation considerably.
It doesn't even need to be complex. Just a few rules: