FasterXML / FasterXML/jackson-dataformats-text

Security feature: Add feature to sanitize strings against CSV injection (aka Formula Injection).

Đang mở
#326 4 bình luận 2 reaction 0 người được giao Xem trên GitHub
csv
Ngôn ngữ chính
Java
Star
455
Fork
164
Merge trung bình
6 ngày 10 giờ
Pull request đã merge (30 ngày)
2

Mô tả

### Summary
We'd like to add a feature to `CsvGenerator` that will enable sanitizing string values against CSV Injection.

`CsvGenerator.Feature.SANITIZE_STRING_VALUES`

The current method of protecting against this vulnerability is not reliable. Specifically, we request that for all string values, all matches that match the regular expression `^[-\=\+@]+` should be replaced by an empty string before the string value is written.

### Background
https://www.veracode.com/blog/secure-development/data-extraction-command-execution-csv-injection

### Rationale
The existing feature that is most-often used to protect against CSV injection is `CsvGenerator.Feature.ALWAYS_QUOTE_STRINGS`. There are two problems with this approach.

1) It unnecessarily augments all string values, regardless of whether those values are malicious.
2) End users may still remove double quotes programmatically in their spreadsheet application, not realizing that they are exposing themselves to a critical security issue.

Many developers are attempting to address the issue by using reflection to manually "sanitize" the declared string fields on their POJOs prior to serializing them as a CSV row. The risk is that they are doing it improperly, allowing exposure to still exist in some form. For example, [one user on stack overflow decided to prepend malicious string with an apostrophe ](https://stackoverflow.com/questions/54754919/configure-csvmapper-to-inspect-each-value-written)(`'`), instead of just removing the offending characters entirely.

Clearly, a more targeted feature is needed to protect the end user.

### Mitigating the Risk
The risk is mitigated by ensuring that the following characters do not appear at the start of the string:

* equals sign (`=`)
* plus sign (`+`)
* minus sign (`-`)
* "At" symbol (`@`)

### Acceptance criteria

Strings should be transformed:

- After the string values are trimmed.
- Before `ALWAYS_QUOTE_STRINGS` is applied.
- Before string values are written.

The following transformations can be used as a guide for feature.

```
=foo --> foo
+foo --> foo
-foo --> foo
@foo --> foo
==foo --> foo
++foo --> foo
--foo --> foo
@@foo --> foo
@+foo --> foo
=-foo --> foo
foo --> foo
foo= --> foo=
fo=o --> fo=o
+-=@fo=o= --> fo=o=
```

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.