Validate CSV file integrity about active-table HOT 4 CLOSED

The input element which opens up the file browser for importCSV method and the import button in csvButtons has been set up to only accept .csv format files (code here).

Are you still able to import non .csv file formats? If so, may I ask if you are able to see them in your file manager before confirming the upload. And what kind of an operating system you are running on? (A screenshot would also be great!)

from active-table.

Even though the input element only accepts .csv files, you can change the selector in the file manager and import, for example a png file on Ubuntu 22

from active-table.

I see what you mean. I did some more research on this and it turns out that there is no bullet proof way to prove that the uploaded file is technically CSV. Aside from narrowing down the available file selection by extension, the code can also check the first couple of bytes of the uploaded file to see if they correspond to characters that are common for CSVs like "ID" and "EF", however these are not standardised and there can be scenarios where these characters are not present in valid CSVs. Hence, I could be invalidating valid cases.

Unfortunately, the bottom of the line is that if users are uploading .csv files that have incorrect binary properties, it has to be up to them to fix on their end as there is no ultimate technical solution for this.

Another two cents from a security perspective: because this is a web component that runs entirely on the client side, the JavaScript can always technically be manipulated and if someone deliberately wants to upload a non valid CSV, they will always be able to. Hence, the component can only do its best to narrow down the file selection for their convenience.

Hope this makes sense and I appreciate your concern!

from active-table.

I am closing this issue as it will not be pursued any further for the time being.

from active-table.