OWASPASVS 5.0 requirement
ASVS-V1.2.10 The application is protected against csv and formula injection.
- Standard
- OWASP ASVS 5.0
- Chapter
- V1 Encoding and Sanitization
- Section
- V1.2 Injection Prevention
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the application is protected against CSV and Formula Injection. The application must follow the escaping rules defined in RFC 4180 sections 2.6 and 2.7 when exporting CSV content. Additionally, when exporting to CSV or other spreadsheet formats (such as XLS, XLSX, or ODF), special characters (including '=', '+', '-', '@', '\t' (tab), and '\0' (null character)) must be escaped with a single quote if they appear as the first character in a field value.