Remediating CSV Injection Assaults In ColdFusion

part
	output = false
	trace = "I present helper strategies for SAFELY serializing Array knowledge as CSV content material."
	{

	// These are used internally, however may also be used externally as properly so as to make
	// the calling code extra apparent (seeing names is simpler than seeing ASCII numbers).
	this.chars = {
		COMMA: ",",
		TAB: chr( 9 ),
		NEWLINE: chr( 10 ),
		CARRIAGE_RETURN: chr( 13 ),
		QUOTES: """",
		ESCAPED_QUOTES: """"""
	};

	/**
	* I initialize the CSV serializer with the given defaults.
	*/
	public void operate init(
		string fieldDelimiter = this.chars.COMMA,
		string rowDelimiter = this.chars.NEWLINE,
		string encoding = "utf-8"
		) {

		variables.defaultFieldDelimiter = fieldDelimiter;
		variables.defaultRowDelimiter = rowDelimiter;
		variables.defaultEncoding = encoding;

	}

	// ---
	// PUBLIC METHODS.
	// ---

	/**
	* I serialize the given array knowledge as a CSV string payload.
	*/
	public string operate serializeArray(
		required array rows,
		string fieldDelimiter = defaultFieldDelimiter,
		string rowDelimiter = defaultRowDelimiter
		) {

		var csvData = rows
			.map(
				( row ) => {

					return( this.serializeArrayRow( row, fieldDelimiter ) );

				}
			)
			.toList( rowDelimiter )
		;

		return( csvData );

	}


	/**
	* I serialize the given array knowledge as a CSV binary payload.
	* 
	* NOTE: This methodology is offered for comfort - once I generate CSV content material, I'm
	* ALMOST ALWAYS then streaming the content material again to the consumer utilizing CFContent, which
	* accepts a binary `variable` attribute.
	*/
	public string operate serializeArrayAsBinary(
		required array rows,
		string fieldDelimiter = defaultFieldDelimiter,
		string rowDelimiter = defaultRowDelimiter,
		string encoding = defaultEncoding
		) {

		return(
			charsetDecode(
				serializeArray( rows, fieldDelimiter, rowDelimiter ),
				encoding
			)
		);

	}

	// ---
	// PRIVATE METHODS.
	// ---

	/**
	* I return a price through which any KNOWN potential CSV injection vector has been escaped.
	* 
	* CAUTION MODIFIES DATA OUTPUT: This works by checking the primary character within the
	* subject; and, if it's a doubtlessly harmful character, it prepends the sphere worth
	* with a single-quote. Some spreadsheet packages will disguise this single-quote; others
	* will render it. As such, it might seem to the top consumer that we have altered their knowledge
	* (which now we have). Sadly, there is no means round this.
	*/
	non-public string operate escapeCsvInjection( required string subject ) {

		change ( subject.left( 1 ) ) ":

				return( "'" & subject );

			break;
			default:

				return( subject );

			break;
		

	}


	/**
	* I return a subject worth that's quoted and through which embedded particular characters have
	* been escaped.
	*/
	non-public string operate escapeField( required string subject ) {

		return(
			this.chars.QUOTES &
			subject.exchange( this.chars.QUOTES, this.chars.ESCAPED_QUOTES, "all" ) &
			this.chars.QUOTES
		);

	}


	/**
	* I serialize the given row, each QUOTING and ESCAPING the content material of every subject.
	*/
	non-public string operate serializeArrayRow(
		required array row,
		required string fieldDelimiter
		) {

		var csvData = row
			.map(
				( subject ) => {

					// NOTE: Calling the toString() methodology to solid every subject to a string
					// in case we're coping with non-string easy values. This enables
					// us to name member-methods in the entire subsequent invocations.
					var escapedValue = toString( subject );
					escapedValue = escapeCsvInjection( escapedValue );
					escapedValue = escapeField( escapedValue );

					return( escapedValue );

				}
			)
			.toList( fieldDelimiter )
		;

		return( csvData );

	}

}

<cfscript>

	serializer = new CsvSerializer();

	rows = [
		[ "ID", "NAME", "EMAIL" ],
		[ 1, "Sarah ""Stubs"" Smith", "sarah.smith@example.com" ],
		[ 2, "John Johnson", "jon.johnson@example.com" ],
		[ 3, "=(3+5)", "#chr( 9 )#dr.evil@example.com" ], // <== CAUTION: Malicious knowledge!
		[ 4, "Jo Jamila", "jo.jamila@example.com" ]
	];

	header
		title = "content-disposition"
		worth = getContentDisposition( "user-data.csv" )
	;
	content material
		sort = "textual content/csv; charset=utf-8"
		variable = serializer.serializeArrayAsBinary( rows )
	;

	// ------------------------------------------------------------------------------- //
	// ------------------------------------------------------------------------------- //

	/**
	* I get the content-disposition header worth for the given filename.
	*/
	non-public string operate getContentDisposition(
		required string filename,
		string disposition = "attachment"
		) {

		var encodedFilename = encodeForUrl( filename );

		return( "#disposition#; filename=""#encodedFilename#""; filename*=UTF-8''#encodedFilename#" );

	}

</cfscript>