← All changes | app/Services/Csv/CsvWriter.php +20 -2 2.2.0 → 2.4.5 View file →

		@@ -50,9 +50,9 @@
50	50	}
51	51
52	52	public function insertOne($row){
53	53	$this->file = fopen($this->filePath, 'a+');
54		- fputcsv($this->file, $row, $this->delimiter, $this->enclosure);
	54	+ fputcsv($this->file, array_map([$this, 'sanitizeCell'], $row), $this->delimiter, $this->enclosure);
55	55	fclose($this->file);
56	56	}
57	57
58	58	public function insertAll($data){
		@@ -57,11 +57,29 @@
57	57
58	58	public function insertAll($data){
59	59	$this->file = fopen($this->filePath, 'a+');
60	60	foreach ($data as $row) {
61		- fputcsv($this->file, $row, $this->delimiter, $this->enclosure);
	61	+ fputcsv($this->file, array_map([$this, 'sanitizeCell'], $row), $this->delimiter, $this->enclosure);
62	62	}
63	63	fclose($this->file);
	64	+ }
	65	+
	66	+ /**
	67	+ * Neutralize spreadsheet formula injection (CWE-1236) by prefixing an
	68	+ * apostrophe onto any string cell that starts with a character a
	69	+ * spreadsheet application would interpret as the start of a formula.
	70	+ */
	71	+ public function sanitizeCell($value)
	72	+ {
	73	+ if (!is_string($value) || $value === '') {
	74	+ return $value;
	75	+ }
	76	+
	77	+ if (preg_match('/^[=+\-@\t\r]/', $value)) {
	78	+ return "'" . $value;
	79	+ }
	80	+
	81	+ return $value;
64	82	}
65	83
66	84	public function output($filename)
67	85	{