23059a1de3
Some checks failed
CodeQL / Analyze (javascript) (push) Failing after 16s
CodeQL / Analyze (python) (push) Failing after 3s
i18n sync check / check:sync (push) Failing after 3s
React Doctor / react-doctor (push) Failing after 16s
Branch Build CE / Build-Push Admin Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Admin Manifest (push) Has been cancelled
Branch Build CE / Build-Push Web Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Web Manifest (push) Has been cancelled
Branch Build CE / Build-Push Space Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Proxy Manifest (push) Has been cancelled
Branch Build CE / Merge Space Manifest (push) Has been cancelled
Branch Build CE / Prepare AIO Assets (push) Has been cancelled
Branch Build CE / Build Setup (push) Has been cancelled
Branch Build CE / Build-Push Live Collaboration Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge Live Collaboration Manifest (push) Has been cancelled
Branch Build CE / Build-Push API Server Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge API Server Manifest (push) Has been cancelled
Branch Build CE / Build-Push Proxy Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Build-Push AIO Docker Image (${{ matrix.arch }}) (push) Has been cancelled
Branch Build CE / Merge AIO Manifest (push) Has been cancelled
Branch Build CE / Upload Build Assets (push) Has been cancelled
Branch Build CE / Build Release (push) Has been cancelled
27 lines
971 B
Python
27 lines
971 B
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Utility functions for safe spreadsheet exports (CSV and XLSX)
|
|
# Characters that trigger formula evaluation in spreadsheet applications
|
|
_CSV_FORMULA_TRIGGERS = frozenset(("=", "+", "-", "@", "\t", "\r", "\n"))
|
|
|
|
|
|
def sanitize_csv_value(value):
|
|
"""Sanitize a value for CSV/XLSX export to prevent formula injection.
|
|
|
|
Prefixes string values starting with formula-triggering characters
|
|
with a single quote so spreadsheet applications treat them as text
|
|
instead of evaluating them as formulas.
|
|
|
|
See: https://owasp.org/www-community/attacks/CSV_Injection
|
|
"""
|
|
if isinstance(value, str) and value and value[0] in _CSV_FORMULA_TRIGGERS:
|
|
return "'" + value
|
|
return value
|
|
|
|
|
|
def sanitize_csv_row(row):
|
|
"""Sanitize all values in a CSV/XLSX row."""
|
|
return [sanitize_csv_value(v) for v in row]
|