3cab48583da254adb44e6c00b7bcd13023563712 New: Add escapeExcelFormula to -api buttons.exportData() and enable it by default for the CSV export button to prevent possible formula injection.

https://datatables.net/forums/discussion/80069

Sync to source repo @3cab48583da254adb44e6c00b7bcd13023563712

Author: dtbuild

datatables.json

@@ -25,5 +25,5 @@
     ],
     "src-repo": "http://github.com/DataTables/Buttons",
     "last-tag": "3.1.2",
-    "last-sync": "fe105bc93f50921112e4f66a698b3312395c9a6a"
+    "last-sync": "3cab48583da254adb44e6c00b7bcd13023563712"
 }

js/buttons.html5.js

@@ -1117,7 +1117,9 @@ DataTable.ext.buttons.csvHtml5 = {
 
 	extension: '.csv',
 
-	exportOptions: {},
+	exportOptions: {
+		escapeExcelFormula: true
+	},
 
 	fieldSeparator: ',',
 

js/buttons.html5.min.js

@@ -1074,7 +1074,9 @@ DataTable.ext.buttons.csvHtml5 = {
 
 	extension: '.csv',
 
-	exportOptions: {},
+	exportOptions: {
+		escapeExcelFormula: true
+	},
 
 	fieldSeparator: ',',
 

js/buttons.html5.min.mjs

@@ -2016,6 +2016,14 @@ Buttons.stripData = function (str, config) {
 		}
 	}
 
+	// Prevent Excel from running a formula
+	if (!config || config.escapeExcelFormula) {
+		if (str.match(/^[=+\-@\t\r]/)) {
+			console.log('matching and updateing');
+			str = "'" + str;
+		}
+	}
+
 	return str;
 };
 
@@ -2738,6 +2746,7 @@ var _exportData = function (dt, inOpts) {
 			stripHtml: true,
 			stripNewlines: true,
 			decodeEntities: true,
+			escapeExcelFormula: false,
 			trim: true,
 			format: {
 				header: function (d) {

js/buttons.html5.mjs

@@ -1976,6 +1976,14 @@ Buttons.stripData = function (str, config) {
 		}
 	}
 
+	// Prevent Excel from running a formula
+	if (!config || config.escapeExcelFormula) {
+		if (str.match(/^[=+\-@\t\r]/)) {
+			console.log('matching and updateing');
+			str = "'" + str;
+		}
+	}
+
 	return str;
 };
 
@@ -2698,6 +2706,7 @@ var _exportData = function (dt, inOpts) {
 			stripHtml: true,
 			stripNewlines: true,
 			decodeEntities: true,
+			escapeExcelFormula: false,
 			trim: true,
 			format: {
 				header: function (d) {