Java bean验证正则表达式摆脱CSV注入

Question

In our java application, users can export data to excel files which are prone to CSV Injection . To avoid this vulnerability, I want to restrict the user input such as =HYPERLINK(E3, F3) if any parameter start with following chars:

Equals to ("=")
Plus ("+")
Minus ("-")
At ("@") 

I tried some regexes:

^[^+=@-]

^((?![+=@-]).)*

But these are not working as expected in bean validation.

Answer 1

You just need to escape the special characters in your regex like this:

String csvInjectionRegex = "^[^\\+\\=@\\-]";

The following characters are the ones that need to be escaped in a regex:

<([{\\^-=$!|]})?*+.>

To escape them you either :

• use the backslash "\\\\"

• or use enclosed each special character in the both \\Q and \\E .Example: ("\\\\Q|\\\\E")

• If you have any doubts use the Pattern.quote(specialString):

String csvInjectionRegex = "^[^"+Pattern.quote("+-=@")+"]";

Answer 2

Try this:

  if (value.matches("^[+=@-].*")) {
      //DO M
  }