Document and data delivery acceptance workshop / 6 MIN READ
Contain spreadsheet formula interpretation in exports
A reader-specific export safety acceptance record showing untrusted cells remain data, without executable fixtures or a universal escape claim.
AI-assisted research and analysis for the SNS Creative Fieldbook
Sources checked 2026-11-07
A CSV export can carry ordinary text that a spreadsheet interprets as a formula. Accept the recipient’s actual reading workflow, not merely the fact that the file parses into the expected number of columns.
What you will leave with: A reader-specific export safety acceptance record showing untrusted cells remain data, without executable fixtures or a universal escape claim.
Use this when
- Staff open exports containing externally supplied text in spreadsheets.
- A safe viewing route may conflict with exact-value machine exchange.
Not exploit development, a universal sanitizer, macro approval or a general spreadsheet formula audit.
Treat the export as an interpretation boundary
OWASP’s CSV Injection article, checked 7 November 2026, explains how untrusted exported values can be interpreted as formulas by spreadsheet software. It warns that quoting or escaping assumptions can fail after saving and reopening and that no single sanitization approach fits every application and downstream consumer. The lesson uses harmless synthetic data and does not provide attack payloads.
Identify who will open the export, with which supported application and for what purpose. A file intended for human review has a different contract from a machine import that must preserve exact source strings. List the fields that can contain externally supplied text, including names, descriptions and free-form notes. Do not assume that a column’s business label prevents an unexpected value from reaching it.
Specify data meaning and safe interpretation together
For each field, record the intended data type, whether formulas are ever legitimate and what transformations the receiving workflow permits. A report of customer comments normally needs those comments treated as data, not evaluated instructions. A genuine calculation workbook is a different artifact with a different acceptance process. Keep those uses separate rather than trying to make one export satisfy contradictory expectations.
Ask the security and implementation owners to choose a supported protection appropriate to the actual reader. Do not prescribe a universal prefix, silently strip meaningful characters or trust CSV quoting as sufficient. A transformation that changes the underlying value may protect one viewing route while breaking a later import. The acceptance record should expose that trade-off so the owner can select a separate safe viewing format when needed.
Exercise the full recipient workflow safely
Use a small harmless fixture approved by the security owner, with representative punctuation, multiline content and benign formula-like text. Never include external links, commands, executable attachments, live customer data or a payload designed to access other files. Record the expected cell boundaries and expected literal content before opening the supplied fixture in the authorized test environment.
Check initial opening, editing if supported, saving and reopening. A first preview can look safe while a later transformation changes interpretation. Inspect whether the cell remains literal data and whether neighboring fields remain correctly separated. Include the documented application and version in the result. Do not disable warnings, enable untrusted macros or weaken protections to complete the test; those actions are not part of acceptance.
Release a bounded export contract
Record the supported route, protection method selected by the qualified owner, observed behavior and known limitations. Separate the human-viewing copy from any exact-value machine exchange when their requirements differ. Label the intended use clearly enough that a colleague does not reuse a transformed report as an authoritative import file. A clean visual layout does not establish that the data remained unchanged.
If the fixture exposes unsafe interpretation, hold the affected export and provide a reproducible, non-executable issue record. The engineer should fix the export boundary and rerun the same workflow, including save and reopen. Acceptance covers that tested route rather than every spreadsheet in existence. No real report is transmitted, security setting changed or production export enabled by this exercise; those actions retain their normal approval requirements.
Make the reasoning concrete.
A fictional event organizer exports attendee-entered company descriptions for staff review. Some descriptions begin with unusual punctuation. The exporter quotes every field and the team assumes that makes the spreadsheet safe in every reader.
Trust the file syntax
Opening: Accept the report because the CSV parser produces the expected rows and columns.
Hypothesis: The transport structure is valid.
Risk: A spreadsheet can still interpret a value instead of displaying it literally.
Accept the recipient workflow
Opening: Use harmless fixtures to check literal treatment through opening, saving and reopening in the supported reader.
Hypothesis: The security owner can judge a specific protection and its data trade-offs.
Risk: The result cannot be generalized to untested applications or machine-import reuse.
The organizer requests a bounded viewing-export design and keeps exact-value exchange separate. No attendee data or executable payload is used.
Take the questions into your next brief.
Use these prompts in your own notes. Nothing is submitted from this page.
Reader
Which application and workflow will consume this export?
Fields
Which values originate outside the trusted reporting process?
Meaning
Which cells must remain literal data and exact strings?
Transformation
What protection and data trade-off has the qualified owner approved?
Roundtrip
What happens after opening, saving and reopening?
Watch for the wrong conclusion.
- Assuming valid CSV syntax prevents formula interpretation.
- Promising one escaping rule works everywhere.
- Testing with real data or dangerous payloads.
Your next action
Write a reader-specific export contract and ask the security owner for a harmless fixture that tests literal interpretation across the full workflow.
Sources & scope
Workflows, fixtures, worksheets and examples are original editorial analysis. Sources support the narrow attributed statements, not measured business results. Platform guidance is scoped to the documented implementation and date checked. Synthetic offline acceptance only; no real redaction, signing, trust change, transmission or account operation is performed.
- CSV Injection →Primary technical documentation · Supports: Supports the interpretation risk and application-specific mitigation limitations. The safe fixture and release contract are original.