fix(output): prevent CSV formula injection - #31
Conversation
| }; | ||
|
|
||
| const sanitize_csv_cell = (s: string): string=>{ | ||
| if (/^[=+\-@\t\r]/.test(s)) |
There was a problem hiding this comment.
There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s))
return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.
| return JSON.stringify(data, null, 2); | ||
| }; | ||
|
|
||
| const print = (data: unknown, opts: Print_opts = {})=>{ |
There was a problem hiding this comment.
src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
- request structured JSON and serialize it locally when CSV output is requested, or
- parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv
| return JSON.stringify(val); | ||
| }; | ||
|
|
||
| const sanitize_csv_cell = (s: string): string=>{ |
There was a problem hiding this comment.
Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false
brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),
artemo-brd
changed the title
2 participants
No description provided.