Drop-in replacement for Python's CSV library that tries to mitigate CSV injection attacks
.. image:: https://img.shields.io/pypi/v/defusedcsv.svg :target: https://pypi.python.org/pypi/defusedcsv
.. image:: https://travis-ci.org/raphaelm/defusedcsv.svg?branch=master :target: https://travis-ci.org/raphaelm/defusedcsv
.. image:: https://codecov.io/gh/raphaelm/defusedcsv/branch/master/graph/badge.svg :target: https://codecov.io/gh/raphaelm/defusedcsv
If your Python application offers CSV export of user-generated data, that user-generated data might contain malicious payloads that might trigger vulnerabilities in the spreadsheet software of the user that downloads the file (i.e. MS Excel or LibreOffice).
This library tries to mitigate that by prepending all cells starting with @, +,
-, =, | or % with an apostrophe ' and additionally replacing all
| characters in these cells with \|. This will of course change the resulting
CSV files, but Excel will not display the ' character to the user.
Tested with Python 3.8 to 3.10.
This library acts as a drop-in replacement for the standard library's csv module. You can use it by just replacing
import csv with from defusedcsv import csv in your code.
CSV Injection Software Attack | OWASP Foundation <https://owasp.org/www-community/attacks/CSV_Injection>_Comma Separated Vulnerabilities | Context Information Security <https://www.contextis.com/resources/blog/comma-separated-vulnerabilities/>_CSV Injection Mitigations & Dangers | ZeroSec - Adventures In Information Security <https://blog.zsec.uk/csv-dangers-mitigations/>_The code in this repository is published under the terms of the Apache License. See the LICENSE file for the complete license text.
This project is maintained by Raphael Michel mail@raphaelmichel.de. See the AUTHORS file for a list of all the awesome folks who contributed to this project.
FAQs
Drop-in replacement for Python's CSV library that tries to mitigate CSV injection attacks
We found that defusedcsv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.