From fb2093402b6fb7dbc54bab3aa84ebaead2615192 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Tue, 17 May 2016 12:01:17 -0400 Subject: [PATCH] FAQ about CSV formula injection Signed-off-by: Isaac Bennetch --- doc/faq.rst | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/doc/faq.rst b/doc/faq.rst index 6b5cac307d..a135115563 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -2175,6 +2175,22 @@ attempts. This is a server configuration problem. Never enable ``display_errors`` on a production site. +.. _faq8_4: + +8.4 CSV files exported from phpMyAdmin could allow a formula injection attack. +------------------------------------------------------------------------------ + +It is possible to generate a :term:`CSV` file that, when imported to a spreadsheet program such as Microsoft Excel, +could potentially allow the execution of arbitrary commands. + +The CSV files generated by phpMyAdmin could potentially contain text that would be interpreted by a spreadsheet program as +a formula, but we do not believe escaping those fields is the proper behavior. There is no means to properly escape and +differentiate between a desired text output and a formula that should be escaped, and CSV is a text format where function +definitions should not be interpreted anyway. We have discussed this at length and feel it is the responsibility of the +spreadsheet program to properly parse and sanitize such data on input instead. + +Google also has a `similar view `. + .. _faqsynchronization: Synchronization