SAFE HANDOFFS
Handle formula-like CSV text deliberately
Separate a faithful data export from a spreadsheet viewing copy, and record exactly which values changed.
A CSV cell can be ordinary text to one program and an instruction to another. The lab never evaluates formulas, but that does not control what a spreadsheet does when it opens a downloaded file. An export decision needs to account for the next application.
Use the lab’s fictional formula example to see the difference. Its value =1+2 remains text in the browser. With the default label option on, the exported CSV contains text: =1+2. The addition is visible and intentional; it is not an invisible promise that all spreadsheet behavior has been made safe.
Separate parsing from interpretation
CSV parsing locates cells. It does not decide whether a cell is a formula. Quoting a value properly can keep a comma in the same field while leaving a spreadsheet free to interpret that value. OWASP documents formula injection risks and notes that behavior differs between spreadsheet applications and workflows.
For the lab exercise, inspect the formula example and compare the table with the CSV export preview. The browser table displays the original =1+2; the labeled export has an additional text prefix. The table has not calculated 3, and the output is not described as a raw copy.
Sources: OWASP — CSV Injection
Make protective changes visible
The default export checks cells, including headings, for formula-like starts. It labels values beginning with =, +, -, @ and their full-width counterparts after leading whitespace, as well as values starting with a tab or newline. Each flagged cell receives the literal prefix text: before CSV quoting.
This conservative rule also labels some legitimate values, such as -12. That is a tradeoff: the exported value changes. The lab reports how many cells are affected, and the CSV preview shows the result. JSON preserves the original strings. If the receiving workflow requires exact text, use the raw representation and control how that workflow imports it.
| Original text | Labeled cell value | Reason |
|---|---|---|
| =1+2 | text: =1+2 | Begins with a formula-like character |
| -12 | text: -12 | Conservative rule also changes negatives |
| 0017 | 0017 | No label; original text preserved |
| Pencils, blue | Pencils, blue | Comma is handled by CSV quoting |
Keep raw exports in an explicit text workflow
Turning the label option off changes the CSV download extension to .csv.txt and shows a warning. The contents are still CSV: all cells are quoted, inner quotes are doubled, and records use CRLF. The extension helps communicate intended handling; it cannot prevent an application or person from opening the file differently.
Open a raw export in a plain-text editor, or use an import process where every relevant column is explicitly text. If another person will receive it, include the intended import choices in the handoff worksheet. Do not describe a raw file as safe merely because the browser preview rendered it as text.
Check the receiving workflow after every transformation
A viewing copy can be saved, exported again, edited or opened in a different program. Each transformation is another opportunity for interpretation to change. OWASP warns that escaping strategies can fail after spreadsheet save-and-reopen cycles; there is no single sanitization strategy for every spreadsheet and downstream consumer.
For your own chosen spreadsheet, record the version, import method, selected column types and whether a formula-like sample remains literal text after reopening. Use only a harmless fictional sample for the exercise. No spreadsheet-specific execution result is claimed by this guide or by the browser-only lab.
Sources: OWASP — CSV Injection
Keep two artifacts when two purposes conflict
A practical handoff may need both an exact data artifact and a labeled viewing artifact. Give them different filenames and record why the latter changed. The lab makes that distinction visible through its raw text, labeled CSV and JSON filenames.
Complete the worksheet with the number of labeled cells, the original-file location under your control and the receiving workflow. If the recipient cannot explain how it will import the file, share the JSON contract or a small text example first. The useful outcome is an agreed interpretation, not a CSV attachment whose behavior everyone assumes.