Security

EatSheet is built to open spreadsheets from people you don't trust. It treats every file as hostile, keeps parsing in a worker, and fails with a clear error code. No library can promise to have no bugs, so these are defences, not a guarantee.

Script in cell content

All cell content is escaped before it reaches the HTML, so a cell containing a script tag shows as text.

Zip bombs

Unzipped size is limited relative to the file's size, up to 256 MB per part and 512 MB in total, and files over the limit are refused with LIMIT_EXCEEDED.

XML entity attacks

Files with XML entities are refused with UNSAFE_FILE.

Path tricks inside the zip

These are refused with UNSAFE_FILE.

Encrypted files

These are refused with UNSAFE_FILE.

Oversized files

Downloads are capped by maxBytes, 25 MB by default, and sheets by maxCells, 5,000,000 cells by default.

Files that hang the page

Parsing runs in a Web Worker, so the page keeps responding. After 30 seconds by default, the worker is ended with TIMEOUT.

Dangerous links

Only http, https and mailto links can open, in a new tab without access to your page. Anything else, such as javascript:, stays plain text. Link text can still differ from where a link goes, as in any spreadsheet.

CSV formula injection

CSV values stay text by default, so =1+1 is never run as a formula.

EatSheet has no server and sends no telemetry. Files are parsed on the device. It only makes a network request when you give it a URL to load, and that request goes to the address you gave it.

On a server

read() has no timeout. If files come from strangers, run it in a worker or child process with your own time limit.

Content Security Policy

Allow the worker with worker-src 'self' and inline styles with style-src 'unsafe-inline'. EatSheet doesn't need eval.

Using the data

If you read values from cell.value, treat them as untrusted input. Escaping only applies to EatSheet's HTML output.

Updates

Keep EatSheet up to date, because fixes ship in new versions.

Email eatsheet.js@gmail.com with the file and what happened. Security issues also qualify for the $10 bug bounty while the pool lasts.

More: SheetJS alternative · SheetJS vs ExcelJS vs EatSheet · Show an uploaded Excel file · React · Vue · Next.js · Angular · Svelte · Electron · Troubleshooting · Docs · Benchmarks