From bdd4c95e3b81801a8fc5c90646ca6738e11e61b9 Mon Sep 17 00:00:00 2001
From: b-l-i-n-d <fahim.faisal.abir@gmail.com>
Date: Fri, 16 Oct 2026 12:50:52 +0600
Subject: [PATCH] feat(security): add sanitizeCsvCell utility function

---
 assets/core/ts/utils/security.ts | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/assets/core/ts/utils/security.ts b/assets/core/ts/utils/security.ts
index 99215ff33a..2f8fd88162 100644
--- a/assets/core/ts/utils/security.ts
+++ b/assets/core/ts/utils/security.ts
@@ -42,3 +42,35 @@ export function escapeAttr(str: string): string {
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;');
 }
+
+/**
+ * Formula injection prevention prefixes (OWASP / CWE-1236)
+ */
+const FORMULA_INJECTION_PREFIXES = ['=', '+', '-', '@', '\t', '\r'] as const;
+
+/**
+ * Sanitizes a single cell value for CSV export to prevent formula injection (OWASP / CWE-1236)
+ * and properly escape commas, double quotes, and newlines.
+ *
+ * @param rawVal - The raw value to sanitize
+ * @returns The sanitized cell string
+ *
+ * @since 4.2.0
+ */
+export function sanitizeCsvCell(rawVal: unknown): string {
+  if (rawVal === null || rawVal === undefined) {
+    return '';
+  }
+
+  let str = String(rawVal);
+
+  if (FORMULA_INJECTION_PREFIXES.some((prefix) => str.startsWith(prefix))) {
+    str = `'${str}`;
+  }
+
+  if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) {
+    return `"${str.replace(/"/g, '""')}"`;
+  }
+
+  return str;
+}