Excel
Removing Personal Data From an Excel File Before Sharing
Remove personal data from an Excel file before sharing: drop author properties, mask or delete columns, clear comments and rebuild a clean copy by script.
7 min read
Tag
security
43 posts
Excel
Hidden Sheets and Metadata Leaking Out of Shared Workbooks
Find hidden sheets, document properties, comments, defined names and pivot caches in a workbook before you share it, with a script that audits the file.
7 min read
Excel
Macros and Why Data Teams Should Block Them by Default
Compare xlsx, xlsm, xls and xlsb for data work, and set a policy that blocks macros by default while allowing reviewed exceptions with a real owner.
7 min read
YAML
Billion Laughs Style Attacks Through YAML Aliases Tested
Build a 378-byte YAML document that expands to 34 MB, measure PyYAML, DuckDB and Go on it, and see which parsers fail early and which wait for the output.
7 min read
Excel
Formula Injection in Excel Exports and How to Stop It
Stop formula injection in xlsx exports: write user text as strings with openpyxl or XlsxWriter, neutralize leading =, +, - and @ characters, and test it.
7 min read
ExcelGuide
Excel Security Problems Developers Overlook in Pipelines
Excel risks a data pipeline inherits: formula injection, macros, zip bombs, XML entity attacks, hidden data and weak passwords, with the checks for each.
17 min read
YAML
Why Loading Untrusted YAML Can Run Code and How to Stop It
How a YAML tag makes a loader build arbitrary objects, with a harmless proof in PyYAML, what safe_load and full_load did with it, and Ruby and Java behavior.
6 min read
YAMLGuide
YAML Security Pitfalls and How to Test Your Own Code
Seven ways YAML hurts: object loading, alias bombs, size, type confusion, duplicate keys, leaked secrets and values used as code, tested in five languages.
17 min read
YAML
Storing YAML Text in a Database Column and Its Pitfalls
What goes wrong when YAML is kept as text in a column: LIKE misses, equal documents compare unequal and garbage is accepted. The jsonb alternative fixes each.
6 min read
XML
Sanitizing Data You Put Into an XML Document Safely
User text put into XML by string formatting can add elements and attributes. See the injection, the escaping that stops it, CDATA, bad characters and names.
7 min read
XML
Limiting XML Size and Depth for Uploads With Measured Limits
Where lxml and ElementTree stop on deep nesting, long text nodes and wide documents, what a tree costs in memory, and the limits to set for uploads.
7 min read
XML
XML Signature Wrapping in Plain Language With a Toy Example
Signature wrapping moves a signed element so the signature verifies while the app reads another. A toy HMAC example shows the gap and the fix.
6 min read