# One-Line Security Fix: How an XLS Quote Escaping Bug in Dify Leaked Spreadsheet Data

> Source: <https://dev.to/truongsontung/one-line-security-fix-how-an-xls-quote-escaping-bug-in-dify-leaked-spreadsheet-data-44pl>
> Published: 2026-09-10 01:09:35+00:00

While auditing Dify (an open-source AI platform), I found a one-line bug in the

XLS spreadsheet parser. User-supplied cell values were not properly quoted

when written to CSV, allowing specially crafted values to inject additional rows

or columns.

The original code:

```
# Vulnerable: no quote escaping
line = ",".join(str(cell) for cell in row)
```

A malicious cell value like `"evil","data` would break out of the CSV

quoting and inject arbitrary columns. If this CSV was later imported by another

process, it could inject data into protected fields.

``` python
# Fixed: use csv module for proper escaping
import csv
import io
output = io.StringIO()
writer = csv.writer(output)
writer.writerow(row)
line = output.getvalue()
```

CSV injection (also called formula injection) is a common vulnerability in apps

that export data to spreadsheet formats. Even though the initial export might

seem harmless, downstream consumers that re-import the data are at risk.

The fix was a single line change — replacing string concatenation with the

proper csv module — but the security impact was significant.

*Follow my bug bounty journey:* [@truongsontung](https://github.com/truongsontung)

*This post is part of my [Autonomous Bug Bounty Hunter](https://dev.to/t/pruongsontung?series=12345) series.*