Loading
feat: #3637800 Add option to escape spreadsheet formulas in CSV exports
Spreadsheet applications can interpret untrusted submission values as formulas. Add an optional apostrophe prefix for risky headers and values, with CSV quote doubling to preserve cell boundaries. Enable escaping by default on new installs, and disable it by default on existing installations, to maintain workflows.
Update the warning to explain the option and link to OWASP. Cover default behavior, supported delimiters, numeric and stringable values, and the Excel UTF-8 marker with unit tests.
Co-Authored-By: Codex noreply@openai.com
Closes #3637800
Edited by cilefen
