Skip to content
SudoSecurity

Sections

securityeasy

Defuse a Spreadsheet Export

100 points · 0 solved

Exported CSV files open in Excel, where a cell like =HYPERLINK(...) runs as a formula (CSV/formula injection). The first line is T; each next line is a CSV row with cells separated by , (no quoting). Print each row with every cell that starts with =, +, - or @ prefixed by a single quote '. Empty cells stay empty.

Example 1 input

2
name,score
eve,=HYPERLINK("http://x")

Expected output

name,score
eve,'=HYPERLINK("http://x")
Learn the technique/learn/secure-coding-in-practice

main.py