开源工具
dev.to ·
@stmanst
一行修复：Dify 的 XLS 引号转义缺陷如何导致表格数据泄露
作者称在审计开源 AI 平台 Dify 时发现 XLS 表格解析器存在一行代码级缺陷：生成 CSV 时未对用户提供的单元格值做引号转义，形如 "evil","data 的恶意值可突破 CSV 引号并注入额外列，若该 CSV 被其他流程重新导入，可能向受保护字段写入数据。修复方案是改用 Python csv 模块的 writer 进行正确转义。文章强调 CSV/公式注入在导出表格的应用中较常见，但未给出 CVE 编号、受影响版本或官方确认。
AI推荐理由 作者称在审计开源 AI 平台 Dify 的 XLS 解析器时发现一处 CSV 引号转义缺陷：用字符串拼接生成 CSV 行，恶意单元格值可突破引号注入额外行列，下游重新导入时可能污染受保护字段；修复方式是改用 Python csv 模块。属于具体、可复现的安全细节，对使用 Dify 或做表格导出的开发者有直接参考价值；但为个人博客自述，未提供 CVE、版本号或官方确认，影响范围需自行核实。
72
正文
The $1 Fix That Prevented Data Leakage
While auditing Dify (an open-source AI platform), I found a one-line bug in the
XLS spreadsheet parser. User-supplied cell values were not properly quoted
when written to CSV, allowing specially crafted values to inject additional rows
or columns.
The Vulnerability
The original code:
# Vulnerable: no quote escaping
line = ",".join(str(cell) for cell in row)
Enter fullscreen mode
Exit fullscreen mode
A malicious cell value like "evil","data would break out of the CSV
quoting and inject arbitrary columns. If this CSV was later imported by another
process, it could inject data into protected fields.
The Fix
# Fixed: use csv module for proper escaping
import csv
import io
output = io.StringIO()
writer = csv.writer(output)
writer.writerow(row)
line = output.getvalue()
Enter fullscreen mode
Exit fullscreen mode
Why This Matters
CSV injection (also called formula injection) is a common vulnerability in apps
that export data to spreadsheet formats. Even though the initial export might
seem harmless, downstream consumers that re-import the data are at risk.
The fix was a single line change — replacing string concatenation with the
proper csv module — but the security impact was significant.
Follow my bug bounty journey: @truongsontung
This post is part of my Autonomous Bug Bounty Hunter series.