Handle Specialized Data Formats Carefully

If your connector handles these specialized formats, apply these security practices.

If your connector parses XML responses, keep the parser defaults unchanged. When you enable externalEntities or supportDtd, you expose the connector to XML External Entity (XXE) attacks and entity-expansion denial-of-service (the “Billion Laughs” attack).

Do: Call read(payload.xml, “application/xml”) with no parser options.

Don’t: Set externalEntities: true or supportDtd: true to work around a parsing issue.

Vulnerable

Secure

If your connector returns CSV, escape leading characters that spreadsheet apps interpret as formulas. A cell that starts with =, +, -, @, a tab, or a carriage return can run arbitrary commands when someone opens the CSV in Excel or Google Sheets.

Do: Prefix risky leading characters with a single quote before you write the CSV.

Don’t: Write user-controlled strings into CSV cells without escaping.

Vulnerable

Secure

If your connector accepts file uploads, multipart parts expose filenames, headers, and content verbatim, with no built-in validation of size, type, or path.

Do: Validate the file type and size, and sanitize filenames before you process or forward the file.

Don’t: Pass multipart content to downstream components unchecked.

Vulnerable

Secure

If your connector reads Excel files, oversized or highly compressed .xlsx archives can expand to gigabytes (zip bombs) and exhaust memory or storage. Size checks alone don’t stop all zip-bomb variants.

Do: Cap the binary size of an Excel upload before you call read(…, “application/xlsx”).

Don’t: Pass application/xlsx input through without a size check.

Vulnerable

Secure