This is one of those things that's going to be stuck in my head for a while. It'...

rahimnathwani · 2024-06-02T18:25:38 1717352738

You probably already knew that Google Apps Script allows your spreadsheet to run functions that can trigger HTTP requests.

Did you know that your spreadsheet can also receive HTTP requests that trigger functions?

thornewolf · 2024-06-02T18:30:39 1717353039

i tried to find some resources on this but came up empty. can you provide a link? sounds like a fun workflow

rahimnathwani · 2024-06-02T18:34:11 1717353251

https://developers.google.com/apps-script/guides/web

notagoodidea · 2024-06-02T19:56:53 1717358213

You are in for a whole lot of magical bad ideas :) Also Google Sheets are "vulnerable" to CSV injection [1] too for "here is a link to an evil CSV, import the data yourself" scenario.

Honestly if there was a way to Auth (even basic Auth or Bearer) via classic Google Sheets, you could create a monster so easily.

[1] http://georgemauer.net/2017/10/07/csv-injection.html

zer00eyz · 2024-06-02T21:13:21 1717362801

CSV injection is an OLD trick! It's one I learned 20 years ago from someone who, was at the time, older than I am now.

> Honestly if there was a way to Auth (even basic Auth or Bearer) via classic Google Sheets, you could create a monster so easily.

Excel/sheets is an IDE for accountants. They make monsters over there all the time!