X-LightYear opened a new issue, #7336:
URL: https://github.com/apache/rocketmq-dashboard/issues/7336

   ## Problem
   
   The shared frontend CSV exporter prefixes every cell whose text starts with 
`-` to protect against spreadsheet formula injection. Metric Explorer export 
rows provide numeric Prometheus samples as JavaScript numbers, so a valid 
negative value such as `-3.5` is emitted with a leading apostrophe. Spreadsheet 
applications then treat the exported value as text instead of a number.
   
   ## Reproduction
   
   1. Open Metrics Explorer with a metric that has a negative sample value.
   2. Export the metric CSV.
   3. Open the CSV in a spreadsheet and inspect the Value column.
   
   The current `escapeCsvCell(-3.5)` result is `"'-3.5"`.
   
   ## Expected behavior
   
   Numeric values already parsed by the application should remain numeric in 
CSV output, while string values beginning with formula characters must remain 
protected.
   
   ## Scope
   
   The fix is limited to the shared CSV escaping helper and its regression 
coverage; no export format or backend behavior changes are required.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to