CSVGuide
CSV Security Risks That Catch Teams Out and What to Do
How a CSV file hurts a team: formula injection, hostile uploads, leaked personal data, hidden payloads and risky loaders, with a fix and a check for each.
17 min read
Tag
security
43 posts
YAML
Generating SQL From YAML Templates Safely With Bound Values
See an f-string builder turn a YAML job file into a dropped table, then fix it with bound values, quoted identifiers and an allow-list of tables.
6 min read
XML
Reading a Medical Style HL7 CDA Document Safely With lxml
Extract the patient id and measurements from a synthetic CDA clinical document with a namespace map, handle nullFlavor and disable entity resolution.
6 min read
YAML
Auditing Kubernetes Manifests With SQL and a Findings Score
Flatten Kubernetes Deployments into one row per container and audit limits, probes, latest tags and privileged mode with SQL, then rank workloads by findings.
7 min read
YAML
Limiting Alias Expansion in a YAML Parser Across Languages
Where each parser sets its alias limit: SnakeYAML options, Go's built-in check, Ruby's aliases flag, DuckDB's node budget and a PyYAML guard, all tested.
7 min read
YAML
Handling YAML Uploads From Users Without Getting Burned
A 40-line guard for accepting YAML uploads: size cap, UTF-8, safe parsing, expanded-size and depth limits, then key checks. Ten test inputs and what each did.
7 min read
Excel
Checking an Excel Upload Before Reading It Into Code
Check an Excel upload before parsing: size, name, zip signature, required parts, macro parts, sheet names and header row, in a fixed order with clear errors.
7 min read
Excel
Password Protected Excel Files and Scripts That Read Them
Read password protected Excel files from a script with msoffcrypto-tool, tell file encryption from sheet protection, and keep passwords out of code and logs.
7 min read
YAML
Secrets Accidentally Committed in YAML Files and the Cleanup
What to do when a token lands in a values or config YAML: removing it from the file leaves it in history, gitleaks finds it, and rotation is the real fix.
6 min read
Excel
Zip Bombs and Oversized XLSX Uploads and Limits That Work
Stop zip bombs and oversized xlsx uploads with limits on file size, entry count, expansion ratio and rows, enforced before parsing and sized from real files.
7 min read
Excel
Opening Untrusted Excel Files Safely in a Pipeline
Open untrusted Excel files in a sandboxed worker with no network, memory and time limits, a read-only parser and no desktop Excel, then load results as data.
7 min read
YAML
Safe Loaders in Python Ruby and Java Compared and Tested
Which function to call in PyYAML, Ruby Psych and SnakeYAML to load untrusted YAML safely, what each default does and how to grep for the unsafe ones.
6 min read