Add warning about opening CSV files with spreadsheets

Spreadsheets are vulnerable to hidden formulas in CSV files. If webform data is submitted by untrusted users, and the submissions are downloaded in CSV format, maliciously-formatted submission data may be used to create a security vulnerability. The Drupal security team has concluded that this vulnerability does not rest in webform, but rather in the spreadsheets. Nonetheless, a warning about opening downloaded submissions in CSV format with spreadsheets should be added to the webform download page.

For more information, see the headings "Formula Injection" and "Exploiting trust relationships" here: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/.

Originally reported by zread.

Solution: Add the following warning to the download page when delimited text format is selected:

Warning: Opening delimited text files with spreadsheet applications may expose you to formula injection or other security vulnerabilities. When the submissions contain data from untrusted users and the downloaded file will be used with spreadsheets, choose Microsoft Excel format. Search "spreadsheet formula injection" for more information.