From 84a957167f99bb569f37a6f4f646ac24339dcd84 Mon Sep 17 00:00:00 2001 From: caub Date: Sun, 5 Dec 2021 14:06:36 +0100 Subject: [PATCH] force quote when escapeFormulae is used (OWASP recommandation) --- papaparse.js | 6 +++++- tests/test-cases.js | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/papaparse.js b/papaparse.js index feafb6e..91de82f 100755 --- a/papaparse.js +++ b/papaparse.js @@ -444,13 +444,17 @@ License: MIT if (str.constructor === Date) return JSON.stringify(str).slice(1, 25); + var needsQuotes = false; + if (_escapeFormulae && typeof str === "string" && _escapeFormulae.test(str)) { str = "'" + str; + needsQuotes = true; } var escapedQuoteStr = str.toString().replace(quoteCharRegex, _escapedQuote); - var needsQuotes = (typeof _quotes === 'boolean' && _quotes) + needsQuotes = needsQuotes + || _quotes === true || (typeof _quotes === 'function' && _quotes(str, col)) || (Array.isArray(_quotes) && _quotes[col]) || hasAny(escapedQuoteStr, Papa.BAD_DELIMITERS) diff --git a/tests/test-cases.js b/tests/test-cases.js index 2972928..d53f8d6 100644 --- a/tests/test-cases.js +++ b/tests/test-cases.js @@ -1881,7 +1881,7 @@ var UNPARSE_TESTS = [ description: "Escape formulae", input: [{ "Col1": "=danger", "Col2": "@danger", "Col3": "safe" }, { "Col1": "safe=safe", "Col2": "+danger", "Col3": "-danger, danger" }, { "Col1": "'+safe", "Col2": "'@safe", "Col3": "safe, safe" }, { "Col1": "\tdanger", "Col2": "\rdanger,", "Col3": "safe\t\r" }], config: { escapeFormulae: true }, - expected: 'Col1,Col2,Col3\r\n\'=danger,\'@danger,safe\r\nsafe=safe,\'+danger,"\'-danger, danger"\r\n\'+safe,\'@safe,"safe, safe"\r\n\'\tdanger,"\'\rdanger,","safe\t\r"' + expected: 'Col1,Col2,Col3\r\n"\'=danger","\'@danger",safe\r\nsafe=safe,"\'+danger","\'-danger, danger"\r\n\'+safe,\'@safe,"safe, safe"\r\n"\'\tdanger","\'\rdanger,","safe\t\r"' }, { description: "Don't escape formulae by default", @@ -1898,7 +1898,7 @@ var UNPARSE_TESTS = [ description: "Escape formulae with single-quote quoteChar and escapeChar", input: [{ "Col1": "=danger", "Col2": "@danger", "Col3": "safe" }, { "Col1": "safe=safe", "Col2": "+danger", "Col3": "-danger, danger" }, { "Col1": "'+safe", "Col2": "'@safe", "Col3": "safe, safe" }, { "Col1": " danger", "Col2": "\rdanger,", "Col3": "safe, \t\r" }], config: { escapeFormulae: true, quoteChar: "'", escapeChar: "'" }, - expected: 'Col1,Col2,Col3\r\n\'\'=danger,\'\'@danger,safe\r\nsafe=safe,\'\'+danger,\'\'\'-danger, danger\'\r\n\'\'+safe,\'\'@safe,\'safe, safe\'\r\n\'\'\tdanger,\'\'\'\rdanger,\',\'safe, \t\r\'' + expected: 'Col1,Col2,Col3\r\n\'\'\'=danger\',\'\'\'@danger\',safe\r\nsafe=safe,\'\'\'+danger\',\'\'\'-danger, danger\'\r\n\'\'+safe,\'\'@safe,\'safe, safe\'\r\n\'\'\'\tdanger\',\'\'\'\rdanger,\',\'safe, \t\r\'' }, { description: "Escape formulae with single-quote quoteChar and escapeChar and forced quotes",