codeant-ai-for-open-source[bot] commented on code in PR #43398:
URL: https://github.com/apache/superset/pull/43398#discussion_r3831865397
##########
superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/index.tsx:
##########
@@ -78,6 +78,35 @@ import { useExploreDataExport } from
'./useExploreDataExport';
export const SEARCH_THRESHOLD = 10;
+/**
+ * Escape a single CSV cell value.
+ *
+ * Mirrors the server-side chokepoint (superset/utils/csv.py escape_value):
+ * values starting with a spreadsheet formula prefix (=, +, -, @, |, %, or a
+ * leading tab/carriage return, optionally behind leading whitespace) are
+ * neutralized with a leading single quote so exported cells cannot execute
+ * as formulas when opened in Excel/LibreOffice/Google Sheets. Plain negative
+ * numbers are left untouched. RFC-4180 quoting is applied afterwards.
+ */
+export const escapeCsvValue = (v: unknown): string => {
+ if (v === null || v === undefined) return '';
+ let s = String(v);
+ if (s.length > 0) {
+ const stripped = s.replace(/^\s+/, '');
+ const startsLikeFormula =
+ s[0] === '\t' ||
+ s[0] === '\r' ||
+ (stripped.length > 0 && '-@+|=%'.includes(stripped[0]));
+ const isNegativeNumber = s.length > 1 && /^-[0-9.]+$/.test(s);
+ if (startsLikeFormula && !isNegativeNumber) {
+ // Escape pipe to be extra safe (DDE payloads), then prefix with a
+ // single quote to prevent formula evaluation.
+ s = `'${s.replace(/\|/g, '\\|')}`;
+ }
+ }
+ return /[",\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
Review Comment:
**Suggestion:** The CSV quoting predicate does not include carriage returns,
so a cell containing a bare `\r` is emitted unquoted and can be interpreted as
a record separator by spreadsheet and CSV consumers. This also affects
formula-prefixed values beginning with `\r`, which are prefixed with a quote
but still remain structurally malformed. Include `\r` in the RFC-4180 quoting
check, ideally alongside `\n`. [api mismatch]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Current View CSV rows can split on bare carriage returns.
- ❌ Carriage-return-prefixed formula payloads can bypass intended cell
containment.
- ⚠️ Affects client-side exports with disabled server pagination.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:**
superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/index.tsx
**Line:** 107:107
**Comment:**
*Api Mismatch: The CSV quoting predicate does not include carriage
returns, so a cell containing a bare `\r` is emitted unquoted and can be
interpreted as a record separator by spreadsheet and CSV consumers. This also
affects formula-prefixed values beginning with `\r`, which are prefixed with a
quote but still remain structurally malformed. Include `\r` in the RFC-4180
quoting check, ideally alongside `\n`.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43398&comment_hash=4446af813d7d92c9ff1b754f23ba655dfa1c0fb848b6b84f479a12b1ad0a4f49&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43398&comment_hash=4446af813d7d92c9ff1b754f23ba655dfa1c0fb848b6b84f479a12b1ad0a4f49&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
