Skip to content

csv mitigateFormulaInjection - #1820

Merged
pjfanning merged 3 commits into
apache:mainfrom
pjfanning:csv-formula
Aug 10, 2026
Merged

csv mitigateFormulaInjection#1820
pjfanning merged 3 commits into
apache:mainfrom
pjfanning:csv-formula

Conversation

@pjfanning

Copy link
Copy Markdown
Member

S-22 (CSV formula injection):

  • Added mitigateFormulaInjection parameter to CsvFormatter (default false)
  • When enabled, prefixes cells starting with =, +, -, @, \t, \r with '
  • Fields are quoted when mitigation is active
  • Exposed in both Scala (CsvFormatting.format) and Java (CsvFormatting.format) APIs
  • Added 7 tests covering all trigger characters, normal text, empty strings, and mixed fields

@pjfanning
pjfanning merged commit a8c1473 into apache:main Aug 10, 2026
103 of 104 checks passed
@pjfanning
pjfanning deleted the csv-formula branch August 10, 2026 08:47
@pjfanning pjfanning added this to the 2.0.0-M2 milestone Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants