fix: add excel macro filter for csv output #1634
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #1634 +/- ##
==========================================
- Coverage 78.49% 78.44% -0.05%
==========================================
Files 291 291
Lines 5975 5986 +11
Branches 980 983 +3
==========================================
+ Hits 4690 4696 +6
- Misses 1072 1076 +4
- Partials 213 214 +1
Flags with carried forward coverage won't be shown. Click here to find out more.
📣 Codecov can now indicate which changes are the most critical in Pull Requests. Learn more |
nedsouza
approved these changes
Apr 19, 2022
| # Trim any leading -, =, + or @ to avoid excel macros | ||
| for cve_entry in formatted_output: | ||
| for key, value in cve_entry.items(): | ||
| cve_entry[key] = value.strip("-=+@") |
There was a problem hiding this comment.
Why only these special characters ?
|
I answered the question out of band but in case anyone else was wondering: those special characters are used in Excel to designate formulae, functions and macros. I got the list out of some internal expert guidance so I'm assuming it to be the complete list of interest most commonly used in excel macro exploits. |
anthonyharrison
pushed a commit
to anthonyharrison/cve-bin-tool
that referenced
this pull request
May 2, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I've added some basic excel macro prevention to the csv output. That means trimming leading special characters (+, -, =, @) used by excel for formulae.
Honestly, it's a bit unlikely that anyone would manage to put an excel macro into the NVD data, but it is possible that folk might share triage with intentional or unintentional comments that parse as macros. Either way, there's no reason for us to allow these characters in output so we might as well add the filter for additional safety.