安全风险：OLEDB Excel
我正在编写一个 Web 应用程序，它将通过打开与经过身份验证的用户提交的 Excel 文件的 OLEDB 连接来读取数据。谁能告诉我以这种方式打开 Excel 文件的安全风险吗？我知道危险的宏可以嵌入到 Excel 文件中，但是使用 OLEDB 连接时这仍然存在风险吗？
谢谢。
I'm writing a web app that will read data from an Excel file submitted by an authenticated user by opening an OLEDB connection to it. Can anyone tell me the security risks of opening up an Excel file this way? I know dangerous macros can be embedded in excel files, but is that still a risk when using a OLEDB connection?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不会，使用 OLEDB 从 Excel 工作簿读取数据不存在“Excel”安全风险。任何安全风险都将通过 ADO (OLEDB) 而不是 Microsoft Excel 应用程序产生。因此，宏不是问题，单元格公式也不是问题。
您可能想搜索“ado oledb security excel”来满足您的好奇心，但我不相信您会发现任何值得担心的事情。
No, there are no "Excel" security risks using OLEDB to read data from Excel workbooks. Any security risks will be through ADO (OLEDB) and not the Microsoft Excel application. Therefore, macros are not a concern, nor are cell formulas.
You may want to search for "ado oledb security excel" to satisfy your curiosity, but I do not believe you will find anything to worry about.
第一个问题是您需要确保文件上传后不能被公众访问。确保文件存储在 Web 根目录之外。您还必须确保他们不会上传带有
.asp或.php扩展名的文件，或者包含../.. 的文件名。 /../../../. “内容类型”是用户控制的变量，检查该值完全是浪费。接下来，当您以这种方式打开 Excel 文件时，必须对其进行解析。这会导致缓冲区溢出，例如
确保您的系统完全是最新的，但即使如此，微软的安全记录也很糟糕，您很可能每年有很多天都容易受到攻击。
The first problem is you need to make sure that after the file uploaded that it cannot be accessed by the public. Make sure the files are stored outside of the web root. You also have to make sure they don't upload a file with a
.aspor.phpextension, or a file name that contains../../../../../. The 'content-type' is a user controlled variable and checking this value is a complete and total waste.Next up, is that when you open an excel file this way it has to be parsed. This leads to Buffer Overflows like this one.
Make sure you system is fully up-to-date, but even then Microsoft has a terrible security track record and its likely that you'll be vulnerable for many days out of each year.