gregnb / gregnb/mui-datatables
CSV injection vulnerability
Open
- Dominant language
- JavaScript
- Stars
- 2.7k
- Forks
- 906
- PR merge metrics
- No merged PRs in 30d
Description
CSV exporting is vulnerable to CSV injection. That is, if a user exports a CSV with a malicious value in the data and then opens in excel, the value will be interpreted as a formula and executed.
See: http://georgemauer.net/2017/10/07/csv-injection.html
It would be nice to have an option in downloadOptions to escape strings that begin with "+","-","@", or "=" by prepending "\t".
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.