Does Handsontable Prevents CSV/Formula Injection?

Tags: #<Tag:0x00007efc609af688>
#1

I was working with handsontable and figured out that it doesn’t prevent CSV Injection in the table as google spreadsheet does.
image
CSV injection defination- https://owasp.org/www-community/attacks/CSV_Injection

#2

We treat such concerns very seriously, and we will investigate that. To start with, please note that:

  1. Handsontable does not have built-in support for the CSV file format. If a user loads a CSV file, it must be through some external integration code and should be sanitized there.
  2. Handsontable, when run in the supported software (web browsers), is isolated from the operating system, so the formulas do not have access to the operating system.
  3. On the above screenshot, it seems that the formulas were pasted from an external source. Pasting formulas from the system clipboard is actually a feature. The same works when you paste from Excel to Google Sheets. If you’d like to disable that, there is a hook for that: https://handsontable.com/docs/api/hooks/#beforepaste

Do you have a recommendation on what we could do to increase the security when dealing with formula input?