George Mauer

Anyone with a love of CSV hasn't been asked to deal with CSV-injection prevention in an enterprise setting, without breaking various customer data formats. There's a dearth of good resources about this around the web, this is the best I've come across: https://georgemauer.net/2017/10/07/csv-injection.html

You are in for a whole lot of magical bad ideas :) Also Google Sheets are "vulnerable" to CSV injection [1] too for "here is a link to an evil CSV, import the data yourself" scenario. Honestly if there was a way to Auth (even basic Auth or Bearer) via classic Google Sheets, you could create a monster so easily. [1] http://georgemauer.net/2017/10/07/csv-injection.html

If your attacker controls the data you're exporting to a CSV file, they can take advantage of a memory safety issue in your CSV exporter to execute arbitrary code on your machine. https://georgemauer.net/2017/10/07/csv-injection.html

First, there's no specification. Second, this: http://georgemauer.net/2017/10/07/csv-injection.html

> t's getting to the point where simply opening a Microsoft Office document is roughly the same as opening a random .exe file. This isn't exactly new. In fact it was much worse the late 90s / early 00s, the heyday of windows viruses. There was absolutely no security, opening an excel document automatically meant running arbitrary code that had full system access (via COM, etc). Many viruses spread over email by word and excel documents. At least now, macros execution is disabled by default. Unless you explicitly enable automatic macro execution on all documents, I wouldn't be too worried about opening a documents. Of course, there's the occasional vuln (http://georgemauer.net/2017/10/07/csv-injection.html) but excel isn't exactly the only software with occasional findings of execution vulnerabilities.

You know you can pop calc with a csv file opened in Excel? from http://georgemauer.net/2017/10/07/csv-injection.html : UserId,BillToDate,ProjectName,Description,DurationMinutes 1,2017-07-25,Test Project,Flipped the jibbet,60 2,2017-07-25,Important Client,"Bop, dop, and giglip", 240 2,2017-07-25,Important Client,"=2+5+cmd|' /C calc'!A0", 240 Yeah - that "=2+5+cmd|' \c calc'!A0" gets Windows to execute code...

Domino's vs. Robles doesn't say you can't use JS. no court ever ordered Domino's to do anything, afaict. all they did was affirm that Robles was allowed to sue Domino's under the ADA (without deciding whether their site was in fact accessible or not.) See http://georgemauer.net/2019/11/04/dominos-v-robles.html for a good breakdown of the rulings. In particular, Robles wanted the court to order Domino's to make their site WCAG-2.0 compliant. WCAG is completely silent on JavaScript. It's possible that some screen readers don't support JavaScript, but if Domino's site used ARIA tags and complied with WCAG the court would almost certainly consider that accessible (there's no official DoJ guidelines on what constitutes accessibility, so the court and businesses have latitude here.) The ADA is all about reasonable accomodations. Supporting major screen readers is reasonable; supporting all of them clearly isn't. 98% of screen reader users have JS enabled (https://webaim.org/projects/screenreadersurvey4/#javascript), so it's clearly reasonable to provide an accessible webapp.