diff --git a/doc/faq.rst b/doc/faq.rst index 8ba5e9f850..07746f8742 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -2175,6 +2175,22 @@ attempts. This is a server configuration problem. Never enable ``display_errors`` on a production site. +.. _faq8_4: + +8.4 CSV files exported from phpMyAdmin could allow a formula injection attack. +------------------------------------------------------------------------------ + +It is possible to generate a :term:`CSV` file that, when imported to a spreadsheet program such as Microsoft Excel, +could potentially allow the execution of arbitrary commands. + +The CSV files generated by phpMyAdmin could potentially contain text that would be interpreted by a spreadsheet program as +a formula, but we do not believe escaping those fields is the proper behavior. There is no means to properly escape and +differentiate between a desired text output and a formula that should be escaped, and CSV is a text format where function +definitions should not be interpreted anyway. We have discussed this at length and feel it is the responsibility of the +spreadsheet program to properly parse and sanitize such data on input instead. + +Google also has a `similar view `. + .. _faqsynchronization: Synchronization