1920114 - Broken password export to csv then import from csv

Status: RESOLVED INVALID

(Toolkit :: Password Manager, defect, P3)

Description

[L.I.A.R.]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0

Steps to reproduce:

Exported passwords as CSV
Added/Modified a few passwords (included I inserted spaces " " after colums ",")
Imported passwords as CSV

Actual results:

Imported login/passes includes the quotes '"' and the spaces " "

Expected results:

Seems that the parsing of CSV can only read exact output of CSV exporter.
It probably consists in a custom code instead of using a library for reading CSVs.
CSV is a very poorly specified format with very nasty border cases (eg. a quoted field that uses a column inside).
It would be better to use a well tested CSV reading/writing library to prevent any exploitation (which could occur with this incorrect custom code).

Comment 1

[Janika Neuberger [:janika]]

Hi! And thanks for filing this bug!

The CSV parser is implemented according to RFC 4180.
From your description I take that you have exported a file containing a record e.g. "https://example.com","username","password" and you manually modified it to "https://example.com","username"," ""password".
I tried the import and the imported password result is: "password (note: there's a leading space), which is as expected according to the RFC 4180.

Including a space surrounded by quotes ignores and breaks the encoding rules in place. In the example above adding " " before "password" will lead to a double quote, which will be decoded to a quote when importing the password.

Please provide an example record (obviously not your real username and password), if you think that there still exists a problem with the csv import.

Comment 2

[Janika Neuberger [:janika]]

No further details are provided from the reporter, so I'm closing this bug as invalid. Please feel free to re-open if you think there is still a problem.