Security Architecture & Threat Model
OpenMIS implements defense-in-depth protections tailored for spreadsheet ingestion and executive file exports.
CSV DDE Formula Sanitization
Prevents formula injection attacks by escaping dangerous characters (=, +, -, @, \t, \r) with single quotes (') upon CSV/XLSX export.
Strict Browser Sandbox Isolation
Parsing executes inside isolated Web Worker threads. No remote endpoints ingest file buffers, eliminating server-side remote code execution (RCE) vectors.
Zero Dynamic Code Execution
No eval() or new Function() is used in OpenMIS. Imported report schemas are validated against strict Zod type boundaries.
Resource Ceiling Safeguards
Guards user devices against memory exhaustion with a 50MB file size ceiling and a 250,000 row hard cutoff, alerting the user gracefully before browser memory limits are reached.
Dynamic Data Exchange (DDE) Defense Explained
When a spreadsheet application such as Microsoft Excel or LibreOffice Calc opens a CSV file, cells starting with =, +, -, or @ are automatically evaluated as executable formulas. If an unverified user imports data containing malicious formulas (e.g. =cmd|'/C calc'!A0), the host computer may execute unauthorized system commands upon opening the file.
OpenMIS features a multi-pass formula sanitizer. It verifies raw cell strings (including leading whitespace and tab characters) and prepends an apostrophe (') to any non-numeric formula string, while preserving legitimate numbers (e.g. -42.50 or +100).
Responsible Vulnerability Disclosure
We take security seriously. If you identify a potential security issue in OpenMIS:
- Submit a private vulnerability report via GitHub Security Advisories.
- Do not publish or disclose the issue publicly until a patched release is tagged.
- Never share real proprietary corporate spreadsheet data in bug reports; provide synthetic mock datasets.