News for hackers. Stuff that matters.
Re:Dangers of CSV Injection by jandrese on Wednesday October 11, 2017 @11:22AM (#15450481)
RFC 4180 just tried to write down what the most common quirks of CSVs were in the wild at the time. It's a reference more than a specification.

It's really a missed opportunity. Had they had the balls to actually specify CSV properly this wouldn't be nearly as much of a problem. This would have probably left a lot of the existing CSV writers non-conformant, but it would have likely improved the future situation considerably.

It doesn't even need to be complex. Just a few rules:

  (basic CSV spec here)
  1. Reserved characters are , " \
  2. If a reserved character appears in a field, escape it with \
  3. Alternatively you can double quote a field, in which case you only need to escape " characters in the field
  4. Line endings are either CR, CR/LF, or LF.  Parsers must suppport all line endings.
  5. Character set is UTF-8, however the " , and \ characters must be 0x22, 0x2C, and 0x5C.  Alternative language lookalike characters will not be treated as control characters.
  6. Whitespace adjacent to a comma is ignored by the parser

There are no comments on this comment yet.