Rule that detects CSV formula injection

Rules and Languages New rules / language support
1

Create a rule that detects code that is writing untrusted data directly to a CSV file or an Excel file without escaping or sanitizing it first.

Untrusted data may contain a formula injection attempt, which can cause a spreadsheet application such as Excel to execute arbitrary commands on the victims machine when the file is opened. See this OWASP article for details.

Noncompliant code:

var stringBuilder = new StringBuilder();
stringBuilder.AppendLine("UserName,Email");
stringBuilder.AppendLine($"{user.Name},{user.Email}");
var csvOutput = stringBuilder.ToString();

Compliant code:

TBD?

I feel that CSV formula injection is a very common security issue, and remediating it fully is not well understood.

10

Hello,

Thanks for the suggestion. I’ve noted it. Let’s see if this feature gets more traction than other opportunities we already identified.

Alex