fix(output): prevent CSV formula injection by zoya-brd · Pull Request #31 · brightdata/cli

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

zoya-brd · 2026-08-31T09:04:49Z

No description provided.

artemo-brd · 2026-08-31T12:54:58Z

 };

+const sanitize_csv_cell = (s: string): string=>{
+ if (/^[=+\-@\t\r]/.test(s))


There is a workaround for formula injection if there is a space before a formula like " =cmd|'/c calc'!A0" . Please detect dangerous prefixes after leading whitespace without removing that whitespace from the exported value. For example:
if (/^[\s\u00a0]*[=+\-@]/.test(s)) return "'" + s;
Please add tests for regular spaces, tabs, and NBSP.
This also changes numeric-looking string values such as "-100" and "+15". Is that intentional? If we want to preserve them, please define a strict numeric-string exemption and add tests. Otherwise, we should document that sanitization intentionally modifies all string cells starting with + or -.

artemo-brd · 2026-08-31T16:00:20Z

 return JSON.stringify(data, null, 2);
 };

 const print = (data: unknown, opts: Print_opts = {})=>{


src/commands/dataset.ts -> handle_pipelines:
handle_pipelines() requests CSV from the API, so the result is already a string. Without -o, print() treats it as raw because format is not passed. With -o file.csv, serialize_csv() still returns the string unchanged before csv_escape.
Passing format to print() alone therefore won't fix the issue. We should choose:
request structured JSON and serialize it locally when CSV output is requested, or
parse the returned CSV and sanitize/re-serialize every cell.
Please add regression tests for both stdout redirection and -o file.csv

artemo-brd · 2026-08-31T16:01:12Z

 return JSON.stringify(val);
 };

+const sanitize_csv_cell = (s: string): string=>{


Please add a global sanitize_csv configuration option that users can set with:
brightdata config set sanitize_csv false brightdata config set sanitize_csv true
It should default to true. Since config values currently enter through the CLI as strings, please validate and convert "true"/"false" to actual booleans when setting or reading this option; "false" must not be treated as a truthy string. Other values should be rejected.
We can add per-command overrides later if needed (scrape, search, pipelines, discover, scraper, browser),

fix(output): prevent CVS formula injection
f89c483

zoya-brd requested a review from artemo-brd August 31, 2026 09:10

artemo-brd reviewed Aug 31, 2026
View reviewed changes

artemo-brd requested changes Aug 31, 2026
View reviewed changes