FasterXML / FasterXML/jackson-dataformats-text

Security feature: Add feature to sanitize strings against CSV injection (aka Formula Injection).

未关闭
#326 4 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看
csv
主要语言
Java
星标
455
派生
164
平均合并
6 天 10 小时
30 天内合并 PR
2

描述

### Summary
We'd like to add a feature to `CsvGenerator` that will enable sanitizing string values against CSV Injection.

`CsvGenerator.Feature.SANITIZE_STRING_VALUES`

The current method of protecting against this vulnerability is not reliable. Specifically, we request that for all string values, all matches that match the regular expression `^[-\=\+@]+` should be replaced by an empty string before the string value is written.

### Background
https://www.veracode.com/blog/secure-development/data-extraction-command-execution-csv-injection

### Rationale
The existing feature that is most-often used to protect against CSV injection is `CsvGenerator.Feature.ALWAYS_QUOTE_STRINGS`. There are two problems with this approach.

1) It unnecessarily augments all string values, regardless of whether those values are malicious.
2) End users may still remove double quotes programmatically in their spreadsheet application, not realizing that they are exposing themselves to a critical security issue.

Many developers are attempting to address the issue by using reflection to manually "sanitize" the declared string fields on their POJOs prior to serializing them as a CSV row. The risk is that they are doing it improperly, allowing exposure to still exist in some form. For example, [one user on stack overflow decided to prepend malicious string with an apostrophe ](https://stackoverflow.com/questions/54754919/configure-csvmapper-to-inspect-each-value-written)(`'`), instead of just removing the offending characters entirely.

Clearly, a more targeted feature is needed to protect the end user.

### Mitigating the Risk
The risk is mitigated by ensuring that the following characters do not appear at the start of the string:

* equals sign (`=`)
* plus sign (`+`)
* minus sign (`-`)
* "At" symbol (`@`)

### Acceptance criteria

Strings should be transformed:

- After the string values are trimmed.
- Before `ALWAYS_QUOTE_STRINGS` is applied.
- Before string values are written.

The following transformations can be used as a guide for feature.

```
=foo --> foo
+foo --> foo
-foo --> foo
@foo --> foo
==foo --> foo
++foo --> foo
--foo --> foo
@@foo --> foo
@+foo --> foo
=-foo --> foo
foo --> foo
foo= --> foo=
fo=o --> fo=o
+-=@fo=o= --> fo=o=
```

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。