CWE一覧に戻る
CWE-1236

CSVファイル内の数式要素の不適切な中和

Improper Neutralization of Formula Elements in a CSV File
脆弱性 作成中
JA

この製品は、ユーザーから提供された情報をカンマ区切り値(CSV)ファイルに保存しますが、表計算製品でファイルを開いたときに、コマンドとして解釈される可能性のある特殊な要素が中和されないか、誤って中和されます。

EN

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Scope: Confidentiality / Impact: Read Application Data; Execute Unauthorized Code or Commands
When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at).
If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula.
Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user.
MITRE公式ページ — CWE-1236