mirror of
https://github.com/actualbudget/actual.git
synced 2026-07-16 23:26:48 -05:00
068185751c
* [AI] Neutralize CSV formula-injection in CLI output and transaction export Prefix cells starting with =, +, -, @, tab, or CR with a single quote so that user-controlled strings (payee/account/category/tag names, notes, etc.) cannot evaluate as formulas when the CSV is opened in Excel, LibreOffice Calc, or Google Sheets. Numeric values are left unprefixed. - packages/cli/src/output.ts: harden escapeCsv used by --format csv - packages/loot-core/src/server/transactions/export/export-to-csv.ts: pass a cast.string option to csv-stringify * [AI] Simplify CSV formula-injection guard - Drop the FormattedCell type; check typeof value === 'number' inline in the CSV path instead of threading an isNumeric flag through formatCellValue - Shorten verbose comments and drop standards-body references * [AI] Remove @ts-strict-ignore from export-to-csv test * [AI] Add release notes for CSV formula-injection fix * [AI] Quote CSV cells containing carriage returns Per RFC 4180, bare \r inside an unquoted field can be interpreted as a record terminator. Extend escapeCsv to also quote on \r so neutralized formula payloads (e.g. "'\rHELLO") are emitted as a single cell. * [autofix.ci] apply automated fixes * [AI] Rephrase release note in user-facing language --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>