Key takeaway
A correctly quoted CSV field can still be interpreted as a formula. Test the intended spreadsheet workflow without changing the canonical evidence silently.
CSV syntax does not decide the cell’s meaning
An export owner checks the delimiter, quotes and row count, then opens the file in a spreadsheet. A note that began with an equals sign appears as a calculated value. The CSV may be structurally correct: the extra interpretation happened when the application decided what that cell meant.
OWASP describes this as CSV or formula injection when untrusted input is embedded in a CSV and a spreadsheet interprets it as a formula. The source lists several triggering characters and notes application and locale differences. For a record package, the first question is whether the approved consumer should read a field as literal source text or execute it as a spreadsheet expression.
Use a harmless viewing fixture
The following hypothetical record contains an ordinary text note whose complete contents are =1+1. The note is evidence to preserve, not an instruction to calculate two. A separate quantity field contains the legitimate numeric value -12. A simplistic rule that modifies every leading minus would damage that quantity while trying to protect text.
The author does not run an external-link formula or use actual source records. A harmless arithmetic expression is sufficient to expose the interpretation boundary. Define the expected content before opening the file: literal text in the note, negative twelve in the quantity, and the exact original strings retained in the canonical export.
A human-viewing derivative may intentionally change how text is encoded or imported. Label it as a derivative and document the change. Do not send the modified viewing copy onward as if its added characters were original business evidence.
| Synthetic field | Intended use | Acceptance evidence |
|---|---|---|
| Note: =1+1 | Literal text | Displays and remains text; not calculated 2 |
| Quantity: -12 | Numeric quantity | Retains negative twelve in its declared type |
| Text containing delimiter/quotes | One literal field | No unintended extra cells |
| Viewing-copy prefix or import rule | Controlled derivative | Canonical text retained; transformation documented |
Choose a consumer-specific route
LibreOffice Calc’s Text Import documentation exposes an Evaluate formulas option. When enabled, expressions starting with an equals sign are evaluated; otherwise they are imported as text. It also offers an explicit Text column type. These are useful controls to test, rather than an assumption that any CSV opener chooses literal text.
Record the application, version, import route, relevant options and expected column types. If the file is intended for programmatic ingestion instead, exercise that parser and schema. A representation suitable for a person viewing a spreadsheet may be unsuitable for a pipeline that treats every prefix as part of the actual value.
OWASP states that there is no universal CSV sanitization strategy safe for every spreadsheet and downstream consumer. Its current discussion also notes that Excel can remove quotes or escape characters when a CSV is saved and reopened. Do not convert an escape recipe into a package-wide safety certificate.
Test the second open as well as the first
The review record should include the original file, controlled viewing output, import settings, displayed and underlying cell values, and the saved/reopened result. Check whether the expression stayed text at each step. A screenshot showing literal characters on the first open is weaker evidence than an inspected round trip through the workflow the recipient will actually use.
Keep the canonical and viewing artifacts separately identified. If the viewing process prefixes text, the recipient needs to know that a subsequent programmatic import may observe that prefix. If the recipient strips it, the original execution risk can return on another spreadsheet open. The transformation and its permitted downstream use therefore belong together.
Include a correctly quoted delimiter case and a legitimate negative numeric case in the fixture. A control that stops one formula but changes the column layout or business quantities has failed a different part of the contract. Count these outcomes separately rather than calling every altered field sanitized.
Return a precise output decision
For this example, the canonical note remains =1+1. The approved spreadsheet view must preserve it as text under recorded settings, and the quantity remains -12. A save/reopen result that activates the note is a hold on that viewing path, not permission to rewrite the source note as two.
Use the inventory to distinguish source text from the intended viewing copy and readiness to assign the round-trip check. This review concerns how a receiving application interprets fields. It does not establish that the source text is accurate, authorized for disclosure, free of every other active-content risk or wanted by a buyer.