github-advanced-security[bot] commented on code in PR #43398:
URL: https://github.com/apache/superset/pull/43398#discussion_r3831862940
##########
superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/index.tsx:
##########
@@ -78,6 +78,35 @@
export const SEARCH_THRESHOLD = 10;
+/**
+ * Escape a single CSV cell value.
+ *
+ * Mirrors the server-side chokepoint (superset/utils/csv.py escape_value):
+ * values starting with a spreadsheet formula prefix (=, +, -, @, |, %, or a
+ * leading tab/carriage return, optionally behind leading whitespace) are
+ * neutralized with a leading single quote so exported cells cannot execute
+ * as formulas when opened in Excel/LibreOffice/Google Sheets. Plain negative
+ * numbers are left untouched. RFC-4180 quoting is applied afterwards.
+ */
+export const escapeCsvValue = (v: unknown): string => {
+ if (v === null || v === undefined) return '';
+ let s = String(v);
+ if (s.length > 0) {
+ const stripped = s.replace(/^\s+/, '');
+ const startsLikeFormula =
+ s[0] === '\t' ||
+ s[0] === '\r' ||
+ (stripped.length > 0 && '-@+|=%'.includes(stripped[0]));
+ const isNegativeNumber = s.length > 1 && /^-[0-9.]+$/.test(s);
+ if (startsLikeFormula && !isNegativeNumber) {
+ // Escape pipe to be extra safe (DDE payloads), then prefix with a
+ // single quote to prevent formula evaluation.
+ s = `'${s.replace(/\|/g, '\\|')}`;
Review Comment:
## CodeQL / Incomplete string escaping or encoding
This does not escape backslash characters in the input.
[Show more
details](https://github.com/apache/superset/security/code-scanning/2591)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
