Skip to content

Instantly share code, notes, and snippets.

@gingeleski

gingeleski/thwart_csv_injection.js

Created November 9, 2019 20:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save gingeleski/3a88a5286bcf98ba33b28b95f430e4ff to your computer and use it in GitHub Desktop.
Save gingeleski/3a88a5286bcf98ba33b28b95f430e4ff to your computer and use it in GitHub Desktop.
Download ZIP
Sanitize CSV data from having any executable functions in its cells.
Raw
thwart_csv_injection.js
var csvData = 'generate,=your(stuff),@here';
// Protect against CSV injection - ensure cells don't have ( ), or start with = @ + - unless followed by digit
csvData = csvData.replace(/([()])/g, '').replace(/(^|[,\n\r])([=@+-]+)(?=[\D\.])/g, (match, offset, string) => {
return match.replace(/[^,\n\r]/g, '');
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment