CsvCellSanitizer
in package
Neutralizes CSV export cells against formula injection.
CSV quoting protects the structure of the file, not the meaning of a cell: a value starting
with =, +, -, @, a tab or CR is evaluated as a formula by Excel or LibreOffice, even
when an anonymous visitor entered it through a public form (e.g. a name on a reservation).
A leading apostrophe is prepended; the spreadsheet hides it and takes the cell as literal
text. A legitimate value starting with - (a negative number) gets it too, which is the
accepted cost of the protection.
IMPORTANT: the sanitizing happens once, centrally, right before fputcsv() in
CsvExportTrait. It does not
belong in renderers: a renderer returns display text and a new renderer would forget it,
leaving the export open to formula injection.
Table of Contents
Constants
- RiskyFirstChars : mixed = ['=', '+', '-', '@', "\t", "\r"]
- Characters that trigger formula evaluation at the start of a cell.
- SkippedWhitespace : mixed = " \n\v\f\x00"
- Whitespace skipped when looking for the first significant character.
Methods
- sanitize() : string
- sanitizeRow() : array<int, string>
Constants
RiskyFirstChars
Characters that trigger formula evaluation at the start of a cell.
private
mixed
RiskyFirstChars
= ['=', '+', '-', '@', "\t", "\r"]
SkippedWhitespace
Whitespace skipped when looking for the first significant character.
private
mixed
SkippedWhitespace
= " \n\v\f\x00"
IMPORTANT: tab and CR are deliberately not listed. They are risky themselves (see self::RiskyFirstChars); skipping them would let a formula hide behind them.
Methods
sanitize()
public
static sanitize(string $value) : string
Parameters
- $value : string
Return values
stringsanitizeRow()
public
static sanitizeRow(array<int, string> $row) : array<int, string>
Parameters
- $row : array<int, string>