The platform enforces restrictions on certain string values to prevent formula injection vulnerabilities. When data is exported to a spreadsheet, values beginning with characters such as = or + can be interpreted as executable formulas by spreadsheet applications. The platform blocks specific patterns at save time to prevent this.
These restrictions apply to String, Text, and HTMLText attributes, and are enforced both when records are saved from screens and when records are written by processes.
Restricted Patterns
The following values are rejected:
Any value containing
<scriptanywhere in the text.Any value beginning with
=,+, or@.Any value beginning with a tab character or carriage return.
Any value where
;,,,', or"is followed by=,+,@, or a newline character.
For example, the value =SUM(30,80) is rejected because it begins with =.
What Happens When a Restricted Value Is Detected
If a restricted pattern is found when saving from a screen, the record is not saved and an error message is displayed.
If a restricted pattern is encountered during process execution, the process fails and a process notification is raised. All processes in the workflow are rolled back — no changes from that execution are committed.
Design Guidance
When building processes or accepting user input that will be written to the platform, avoid values that begin with formula-style characters. Validate and sanitise external inputs before passing them to the platform, and ensure import data does not contain restricted patterns. These restrictions are enforced at the platform level and cannot be bypassed or configured.