FasterXML / FasterXML/jackson-dataformats-text
Security feature: Add feature to sanitize strings against CSV injection (aka Formula Injection).
- Dominant language
- Java
- Stars
- 455
- Forks
- 164
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 2
Description
### Summary
We'd like to add a feature to `CsvGenerator` that will enable sanitizing string values against CSV Injection.
`CsvGenerator.Feature.SANITIZE_STRING_VALUES`
The current method of protecting against this vulnerability is not reliable. Specifically, we request that for all string values, all matches that match the regular expression `^[-\=\+@]+` should be replaced by an empty string before the string value is written.
### Background
https://www.veracode.com/blog/secure-development/data-extraction-command-execution-csv-injection
### Rationale
The existing feature that is most-often used to protect against CSV injection is `CsvGenerator.Feature.ALWAYS_QUOTE_STRINGS`. There are two problems with this approach.
1) It unnecessarily augments all string values, regardless of whether those values are malicious.
2) End users may still remove double quotes programmatically in their spreadsheet application, not realizing that they are exposing themselves to a critical security issue.
Many developers are attempting to address the issue by using reflection to manually "sanitize" the declared string fields on their POJOs prior to serializing them as a CSV row. The risk is that they are doing it improperly, allowing exposure to still exist in some form. For example, [one user on stack overflow decided to prepend malicious string with an apostrophe ](https://stackoverflow.com/questions/54754919/configure-csvmapper-to-inspect-each-value-written)(`'`), instead of just removing the offending characters entirely.
Clearly, a more targeted feature is needed to protect the end user.
### Mitigating the Risk
The risk is mitigated by ensuring that the following characters do not appear at the start of the string:
* equals sign (`=`)
* plus sign (`+`)
* minus sign (`-`)
* "At" symbol (`@`)
### Acceptance criteria
Strings should be transformed:
- After the string values are trimmed.
- Before `ALWAYS_QUOTE_STRINGS` is applied.
- Before string values are written.
The following transformations can be used as a guide for feature.
```
=foo --> foo
+foo --> foo
-foo --> foo
@foo --> foo
==foo --> foo
++foo --> foo
--foo --> foo
@@foo --> foo
@+foo --> foo
=-foo --> foo
foo --> foo
foo= --> foo=
fo=o --> fo=o
+-=@fo=o= --> fo=o=
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.