Formula Injection in Express with Bearer Tokens

Formula Injection occurs when untrusted input is interpreted as a formula or expression by a downstream system such as a spreadsheet processor, report generator, or query engine. In an Express application that uses Bearer Tokens for API authentication, the risk arises when token values or data extracted from token claims are incorporated into outputs that are later consumed by these external systems.

Consider an endpoint that exports user data to a CSV file and places the Bearer Token or a claim from it (e.g., user ID or role) into a cell without proper escaping. If the token includes characters such as =, +, -, or @, or if user-controlled data is appended to the token context, spreadsheet applications may interpret the cell content as a formula. For example, a token claim containing =1+2 could cause Excel to evaluate arithmetic, potentially leading to data exfiltration or unintended execution when the file is opened.

Another scenario involves logging or audit trails. If an Express route logs Authorization headers including the Bearer Token into a file that is later imported into a SIEM or analysis tool that parses expressions, special characters in the token could trigger injection in the parsing tool. Even in API responses, returning raw token material within JSON fields that are later rendered in admin dashboards or exported reports can create injection opportunities if those outputs are used in contexts that interpret formulas or script-like syntax.

The combination of Bearer Tokens and Express is particularly sensitive when developers mistakenly treat token strings as safe because they are cryptographically signed. Signature integrity does not prevent misuse of token content in downstream contexts. For instance, an attacker who can influence data stored alongside tokens (such as profile fields or organization names) might craft values that, when concatenated with the token or its claims, produce malicious formulas. This is not a flaw in the token format itself, but a failure of output encoding when the token’s context overlaps with data processed by formula-aware applications.

Real-world patterns include endpoints like /api/export/users that generate CSV attachments with columns for user_id, role, and auth_token. If these values are not sanitized, an exported file can be weaponized. Similarly, webhook payloads that include bearer token identifiers in URLs or body fields may introduce injection if the consumer evaluates expressions. The key takeaway is that Bearer Tokens should be treated as opaque strings and never concatenated with or interpolated into outputs that may be interpreted by external systems without strict input validation and output encoding.

Remediation focuses on ensuring Bearer Token content is never interpreted as executable or formulaic material in downstream consumers. In Express, this means strict separation between authentication and data representation, and defensive handling of any value derived from the token or its claims.

First, avoid including raw Bearer Token values in responses, logs, or exports. If you must reference a token for audit purposes, hash or truncate it, and treat it as an opaque identifier. Here is an example of safe token handling in an Express route:

const express = require('express');
const crypto = require('crypto');
const app = express();

app.get('/api/export/users', (req, res) => {
  const authHeader = req.headers.authorization || '';
  const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;

  // Do not include raw token in output
  const tokenHash = token ? crypto.createHash('sha256').update(token).digest('hex') : null;

  const users = [
    { id: 1, role: 'admin', auth_ref: tokenHash },
    { id: 2, role: 'user', auth_ref: tokenHash }
  ];

  // Encode fields that may be imported into spreadsheets
  const csv = users.map(u => [
    u.id.toString(),
    u.role,
    `"${(u.auth_ref || '').replace(/"/g, '""')}"`
  ].join(',')).join('\n');

  res.setHeader('Content-Type', 'text/csv');
  res.attachment('users.csv');
  res.send(csv);
});

Second, implement output encoding for any data that may be combined with token context. When generating CSVs or reports, wrap fields in quotes and escape existing quotes to prevent formula injection at the application level. The above example demonstrates CSV formatting with proper quoting and escaping.

Third, validate and sanitize claims extracted from tokens before using them in any downstream processing. If a claim is used to construct file names, query parameters, or log entries, apply strict allow-lists and encode special characters. For JSON-based exports consumed by web applications, ensure content types are set correctly and that values are serialized safely rather than interpolated into JavaScript code.

Finally, use the middleBrick CLI to scan your Express endpoints and verify that Bearer Token handling does not introduce injection risks. Run middlebrick scan <url> to get a security risk score and findings specific to authentication and output handling. The dashboard and GitHub Action integrations can help you track these issues over time and fail builds if risk thresholds are exceeded.