When you upload a CSV file, CoreView checks each cell for content that could behave as a harmful command when the file is opened in Excel or Google Sheets. If a cell matches the blocked pattern, the upload stops and CoreView displays an error identifying the cell location.
This article explains how to manage the “Formula injection is not allowed” error within a CSV upload.
Note: names, phone numbers, job titles, and addresses are not blocked unless they meet the conditions herewith described.
Cells are blocked only when two conditions apply
CoreView blocks a cell only when it both starts like a formula and contains a pipe character or a listed risky function:
-
The cell starts like a formula: after ignoring spaces and hidden characters at the beginning of the cell, the first relevant character is
=,+,-, or@. -
The cell contains risky content: the cell contains either a pipe character
(|)or one of the listed functions.
A cell that starts with + or - is accepted when it contains neither a pipe character nor a listed risky function.
Functions that cause a formula-like cell to be blocked
Function names are matched without regard to capitalization. For example, =hyperlink(…) is blocked in the same way as =HYPERLINK(…).
| Function | Normal use |
|---|---|
HYPERLINK |
Creates a clickable link. |
WEBSERVICE |
Fetches data from a website. |
IMPORTXML, IMPORTDATA, IMPORTHTML, IMPORTFEED, IMPORTRANGE
|
Pull data from other sources. |
FILTERXML |
Reads XML data. |
IMAGE |
Loads a picture from a web address. |
DDE, CMD, MSEXCEL, CALL, REGISTER, EXEC
|
Runs programs or commands on a computer. |
Examples of accepted cell content
| Cell content | Why it is accepted |
|---|---|
+1 555 0100 |
This is a phone number. It starts with +, but contains no pipe character or risky function. |
+39 06 1234567 |
This also starts with +, but contains no pipe character or risky function. |
-42 |
This is a negative number. |
@team |
It starts with @, but contains no risky content. |
#12345 or % complete
|
# and % are not treated as formula starters. |
Director | Sales |
It contains a pipe character but does not start like a formula. |
=2+2 |
This calculation contains no pipe character or risky function. |
Examples of blocked cell content
| Cell content | Why it is blocked |
|---|---|
=cmdl' /C calc'!A0 |
It starts with = and contains a pipe character. This attempts to run a program. |
+cmdl' /C calc'!A0 |
It starts with + and contains a pipe character. |
=HYPERLINK("http://example.com","Click") |
It starts with = and calls HYPERLINK. |
=SUM(HYPERLINK("http://example.com","Click")) |
The risky function appears inside another function and is still found. |
=WEBSERVICE("http://example.com") |
It calls WEBSERVICE. |
Formatting does not bypass the check
- Leading spaces: a formula preceded by spaces is still blocked.
- Hidden characters: invisible characters placed before a formula do not prevent the cell from being blocked.
- Multiple lines: a formula split across multiple lines within one cell is still blocked.
Use the error location to find the blocked cell
The error identifies the row and column of the blocked cell but does not repeat the cell content:
CSV contains invalid characters. Formula injection is not allowed. Row:5, Column: 3 (PhoneNumber)
- Row is the row number displayed in Excel. Row 1 is the header row, so the first data row is row 2.
- Column is the number of the column from the left, followed by its heading in parentheses.
In this example: review row 5, column 3, named PhoneNumber.
Replace the blocked content and upload the file again
- Open the CSV file and go to the row and column reported in the error.
- Review the cell content:
- For a value such as a phone number or name, look for a stray pipe character or a listed function name.
- For a formula, replace it with its plain result. For example, replace
=HYPERLINK("http://example.com","Click")withhttp://example.com.
- Save the file and upload it again.
CSV formula checks FAQ
Can you upload phone numbers that start with +?
Yes. For example, +1 555 0100 is accepted because it contains no pipe character or listed risky function.
Can you use a pipe character in a job title or description?
Yes, provided that the cell does not start with =, +, -, or @. For example, Director | Sales is accepted, while =A1|B1 is blocked.
Why does the error not show the cell content?
The content could contain personal data or unsafe text. The error therefore provides only the cell location.
Is a formula such as =2+2 allowed?
Yes. Only formulas that contain a pipe character or one of the listed functions are blocked. Plain values are safer and recommended for imports.