How to apply xss filter on a csv file
Well to my knowledge Drupal doesn't mind the input/import data that much, as long as it's rendered in a secure way. 


  So what we really have to do is make sure that, regardless the data, its content can never be interpreted as SQL. To do this, we use the escaping functions provided by the database API. We do this escaping in the database layer and not directly after receiving input as it may not be the only escaping (or filtering) we have to do. - https://www.drupal.org/node/101495


Just my 2 cents :)