The csv module. csv.writer + writerow on user-controlled cells produces CSV-formula injection when the receiver opens the CSV in Excel (cells starting with =, +, -, @ are interpreted as formulas). No stdlib sanitizer — prefix with a tab or apostrophe.
.reader().DictReader().reader()Sourcecsv.reader(csvfile, dialect='excel', **fmtparams) -> _reader
Creates a CSV reader. Rows are sources when the file is user-supplied.
return.DictReader()Sourcecsv.DictReader(f, fieldnames=None, ...) -> DictReader
CSV reader that maps rows to dicts. Source on untrusted CSV files.
return.writer()Neutralcsv.writer(csvfile, dialect='excel', **fmtparams) -> _writer
Creates a CSV writer. writerow() with user-controlled cells is a formula-injection sink.
.DictWriter()Neutralcsv.DictWriter(f, fieldnames, ...) -> DictWriter
Dict-based CSV writer. Formula-injection sink on user cells.
| FQN | Field | |
|---|---|---|
| csv | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyCsv