Active Content in CSV Exports: Keeping Data Cells from Becoming Commands

Preserve the meaning of data

Assess the intended receiving application and whether it interprets free text as formulas. Preserve traceability between the authoritative value and any protected display representation. Escaping or prefixing used for safe viewing must not later re-enter another system as if it were the original observation. Application teams should select appropriate controls for the actual export and review context.

Worked example

For example, a comment begins with a character that spreadsheet software treats as a formula marker. When the reviewer opens the export, the cell no longer appears as plain text. The team tests whether the protected review copy preserves readable content and whether subsequent re-import could accidentally alter the authoritative source value.

Review checks

• Test opening examples containing unexpected formula-like starting characters.
• Compare the source value with the representation protected for viewing.
• Define controls preventing a review copy from being reloaded as authoritative data.

Acceptance and boundaries

Acceptance includes readable text without unexpected processing and an ability to verify the original value in its controlled source. A file extension alone is not a security guarantee. This is a design review for preserving clinical data meaning and access boundaries as information moves between tools, rather than an instruction for carrying out a particular attack technique.

Frequently asked questions

Is a CSV file not simply plain text?

The file may be plain text, but the application opening it can interpret some cells as active expressions.

Does a protected copy become the original record?

Only if the approved record arrangements define that role. A generated review copy does not automatically become authoritative.

Sources

1. FDA — Electronic systems, records and signatures in clinical investigations
2. MHRA — Guidance on GxP data integrity