One-Line Security Fix: How an XLS Quote Escaping Bug in Dify Leaked Spreadsheet Data

The $1 Fix That Prevented Data Leakage

While auditing Dify (an open-source AI platform), I found a one-line bug in the
XLS spreadsheet parser. User-supplied cell values were not properly quoted
when written to CSV, allowing specially crafted values to inject additional rows
or columns.

The Vulnerability

The original code:

# Vulnerable: no quote escaping
line = ",".join(str(cell) for cell in row)

A malicious cell value like "evil","data would break out of the CSV
quoting and inject arbitrary columns. If this CSV was later imported by another
process, it could inject data into protected fields.

The Fix

# Fixed: use csv module for proper escaping
import csv
import io
output = io.StringIO()
writer = csv.writer(output)
writer.writerow(row)
line = output.getvalue()

Why This Matters

CSV injection (also called formula injection) is a common vulnerability in apps
that export data to spreadsheet formats. Even though the initial export might
seem harmless, downstream consumers that re-import the data are at risk.

The fix was a single line change — replacing string concatenation with the
proper csv module — but the security impact was significant.

Follow my bug bounty journey: @truongsontung

---

This post is part of my Autonomous Bug Bounty Hunter series.