# Beware CSV files!
**URL:** https://cog.discourse.group/t/beware-csv-files/1366
**Category:** useful info
**Created:** [October 16, 2017, 7:03pm UTC](https://cog.discourse.group/t/beware-csv-files/1366 "2017-10-16T19:03:59Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@dakboy](https://cog.discourse.group/u/dakboy)
#### Post date: [October 16, 2017, 7:03pm UTC](https://cog.discourse.group/t/beware-csv-files/1366/1 "2017-10-16T19:03:59Z")
“Common knowledge” was that CSV files were safe - just plain text, right?
[Wrong](http://georgemauer.net/2017/10/07/csv-injection.html). Not even safe with Google Docs.
---
### Author:  [@Woodman](https://cog.discourse.group/u/Woodman)
#### Post date: [October 16, 2017, 7:29pm UTC](https://cog.discourse.group/t/beware-csv-files/1366/2 "2017-10-16T19:29:06Z")
Hunh, having dealt with enough stupid data in CSV files I actually knew some of this without knowing it was something not everyone knew.
OTOH, in my prior jobs accepting crappy files from unknown sources was part of the job description. I should have had my own firewall along with the salesdroids.
---
### Author:  [@dakboy](https://cog.discourse.group/u/dakboy)
#### Post date: [October 16, 2017, 8:30pm UTC](https://cog.discourse.group/t/beware-csv-files/1366/3 "2017-10-16T20:30:58Z")
> [@Woodman](#):
>
> having dealt with enough stupid data in CSV files I actually knew some of this without knowing it was something not everyone knew.
I trade in CSV files all the time, but I’m usually the one creating them from a database, or importing them into a DB without Excel in the mix, so I’ve never really considered it. I do have to watch out for SQL injection, and Excel being stupid about auto-converting column formats though.
---
### Author:  [@Woodman](https://cog.discourse.group/u/Woodman)
#### Post date: [October 16, 2017, 8:43pm UTC](https://cog.discourse.group/t/beware-csv-files/1366/4 "2017-10-16T20:43:09Z")
> [@dakboy](#):
>
> creating them from a database, or importing them
Hah, most of mine weren’t created so much as spawned. Spit out by a database at location X, zipped, and password protected, then opened in excel, sent to someone using only notepad on their phone, sent to someone who opened it in google docs, who printed it and then scanned it and zipped password protected everything again. Then opened up as a PDF, converted to a word file and then stripped by some over zealous IT dude down to a CSV and sent to me… without headers or a data dictionary.
---
### Author:  [@RRabbit42](https://cog.discourse.group/u/RRabbit42)
#### Post date: [October 18, 2017, 12:45am UTC](https://cog.discourse.group/t/beware-csv-files/1366/5 "2017-10-18T00:45:21Z")
This sounds familiar.
“I’ve got it! Browser Helper Objects! They’ll make Internet Explorer more functional and useful. Oh, BHOs are allowing too much access to the system. Better shut them down.”
“Here’s another idea. Let’s leave all the ports wide open on the computer. Oops. Something got in. Shut that port. Another thing got in. Shut that one, too. Ugh. Another one. Better shut all of them off.”
---
### Author:  [@balance](https://cog.discourse.group/u/balance)
#### Post date: [October 18, 2017, 1:51am UTC](https://cog.discourse.group/t/beware-csv-files/1366/6 "2017-10-18T01:51:57Z")
> [@RRabbit42](#):
>
> “Here’s another idea. Let’s leave all the ports wide open on the computer. Oops. Something got in. Shut that port. Another thing got in. Shut that one, too. Ugh. Another one. Better shut all of them off.”
I feel like it’s more, “Better have a separate process that acts as a firewall.”
I guess it’s trivial to have a (well-written, integrated) firewall running as a service/daemon/tsr/whatever nowadays, but I do sometimes wonder if the Classic MacOS did something “right” in that it basically didn’t have ports open unless you specifically asked for them to be open, and ran a very minimal OS by modern standards.
OTOH, macOS does a lot of cool stuff, and I don’t miss troubleshooting extension conflicts.
---
### Author:  [@Ook](https://cog.discourse.group/u/Ook)
#### Post date: [October 18, 2017, 10:36am UTC](https://cog.discourse.group/t/beware-csv-files/1366/7 "2017-10-18T10:36:56Z")
That’s it. I’ll use this attack vector the next time some alien bigwig drops by and decides to exterminate all of us. 😆
But seriously, it is scary as I frequently use CSV files… Meh.
---
### Author:  [@CaffeinatedNoms](https://cog.discourse.group/u/CaffeinatedNoms)
#### Post date: [October 20, 2017, 11:27am UTC](https://cog.discourse.group/t/beware-csv-files/1366/8 "2017-10-20T11:27:59Z")
Fortunately it doesn’t work at all with Numbers (hey, what _does_ work?) but yeah, if that exploit happens with both MSOrifice and Googleshits then this could be… _interesting_.
---
### Author:  [@Viking](https://cog.discourse.group/u/Viking)
#### Post date: [October 23, 2017, 8:27am UTC](https://cog.discourse.group/t/beware-csv-files/1366/9 "2017-10-23T08:27:16Z")
> [@CaffeinatedNoms](#):
>
> it doesn’t work at all with Numbers (hey, what does work?)
I don’t know? What _does_ work with Numbers??