Add option to prevent CSV injection

[zoellner]

Feature request to add an option that if set will "ensure that no cells begin with any of the following characters:
Equals to (=)
Plus (+)
Minus (-)
At (@)
Tab (0x09)
Carriage return (0x0D)
"

https://github.com/OWASP/www-community/blob/master/pages/attacks/CSV_Injection.md

[AckerApple]

I don't see that being implemented. Maybe?

You may want to try something like the following, for that need:

const jsonexport = require('jsonexport');

const data = [
  { name: '=John', age: 30 },
  { name: '+Jane', age: 25 },
  { name: 'Bob', age: 22 },
];

const sanitizeCellValue = (value) => {
  if (typeof value !== 'string') return value;
  const forbiddenStartChars = ['=', '+', '-', '@', '\t', '\r'];
  return forbiddenStartChars.includes(value[0]) ? `'${value}` : value;
}

jsonexport(data, { valueCallback: sanitizeCellValue }, (err, csv) => {
  if (err) return console.error(err);
  console.log(csv);
});

Good luck!

[zoellner]

it is not implemented right now, that's why I added this feature request

It can certainly be done using the typeHandlers with something like this:

    typeHandlers: {
      String: function (value, _index, _parent) {
        // Prepend single quote only if string starts with potentially dangerous characters
        const dangerousCharsRegex = /^[=+\-@\t\r]/;
        if (dangerousCharsRegex.test(value)) {
          return `'${value}`;
        }

        // Return original value if it doesn't start with dangerous chars
        return value;
      },
    },

But I think it would be good to add an easier option to do this which would not only simplify the implementation but also raise awareness of this potential issue.