Skip to content

Commit 0e5e8f0

Browse files
Add line feed (0x0A) to CSV injection character escape list (#1116)
- Added Line feed (0x0A) to the list of characters to escape for CSV injection prevention - This ensures more complete and platform-agnostic guidance for developers - Addresses the gap where Unix-based systems using \n as default newline character were not explicitly covered - Fixes issue #1115
1 parent ae4db04 commit 0e5e8f0

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

pages/attacks/CSV_Injection.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ begin with any of the following characters:
3333
- At (`@`)
3434
- Tab (`0x09`)
3535
- Carriage return (`0x0D`)
36+
- Line feed (`0x0A`)
3637

3738
Keep in mind that it is not sufficient to make sure that the untrusted user input does not start with these characters. You also need to take care of the field separator (e.g., '`,`', or '`;`') and quotes (e.g., `'`, or `"`), as attackers could use this to start a new cell and then have the dangerous character in the middle of the user input, but at the beginning of a cell.
3839

0 commit comments

Comments
 (0)