gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FAQ about CSV formula injection

Browse Source 
Signed-off-by: Isaac Bennetch <bennetch@gmail.com>
This commit is contained in:
Isaac Bennetch 2016-05-17 12:01:17 -04:00
parent 4585c1785b
commit fb2093402b
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
doc/faq.rst
View File

@ -2175,6 +2175,22 @@ attempts.
This is a server configuration problem. Never enable ``display_errors`` on a production site.
.. _faq8_4:
8.4 CSV files exported from phpMyAdmin could allow a formula injection attack.
------------------------------------------------------------------------------
It is possible to generate a :term:`CSV` file that, when imported to a spreadsheet program such as Microsoft Excel,
could potentially allow the execution of arbitrary commands.
The CSV files generated by phpMyAdmin could potentially contain text that would be interpreted by a spreadsheet program as
a formula, but we do not believe escaping those fields is the proper behavior. There is no means to properly escape and
differentiate between a desired text output and a formula that should be escaped, and CSV is a text format where function
definitions should not be interpreted anyway. We have discussed this at length and feel it is the responsibility of the
spreadsheet program to properly parse and sanitize such data on input instead.
Google also has a `similar view <https://sites.google.com/site/bughunteruniversity/nonvuln/csv-excel-formula-injection>`.
.. _faqsynchronization:
Synchronization