I went looking for a simple parser example. Sheetjs's "complete" implementation is 18k loc: https://github.com/SheetJS/js-xlsx/blob/master/xlsx.js

But at least the work has been done for me.

A rather more manageable read can be found at https://github.com/woahdae/simple_xlsx_reader/blob/master/li... which seems to illuminate the basics of the xlsx format in exactly the way I was hoping.

You mean does Google Sheets suffer from the same vulnerabilities? IMPORTXML is a Google Sheets function and isn't in Excel.

My php-based xlsx parser is about 100 lines. If you don't need time series you can save almost twenty lines. Strings cost about ten lines. Even still, whilst it may not support every string-type or every time format, it is more reliable than any CSV parser...

If you are opening up the resulting file in excel, yes. If you are writing your own minimal XLSX parser like geocar say he has, probably not. It's unlikely that your own parser is going to implement the functionality to go send an arbitrary AJAX request.