diff options
| author | Gabriel Morcote <[email protected]> | 2019-12-20 15:01:35 -0600 |
|---|---|---|
| committer | Stefan Daschek <[email protected]> | 2019-12-20 22:01:35 +0100 |
| commit | 0a223011a26949ddc00eba882005daee7afeb6a6 (patch) | |
| tree | a5ffc3459f43e0efef8326dbd1738cac5c5dbc0f /docs | |
| parent | 99d3d2fbe5b07aa005b475b8cdc4e6238c3d5e28 (diff) | |
| download | caxlsx-0a223011a26949ddc00eba882005daee7afeb6a6.tar.gz caxlsx-0a223011a26949ddc00eba882005daee7afeb6a6.zip | |
Add option to protect against formula injection attacks (#34)
Caxlsx used to treat cell values beginning with an equal sign as formula by default.
This can be dangerous if the input data is user generated or coming from other untrusted sources (see https://www.owasp.org/index.php/CSV_Injection for details).
This commit adds a new option `escape_formulas` that can be used with `#add_row` and on instances of `Cell`. If set to true, cell values beginning with an equal sign are treated as normal strings (and will be displayed literally by Excel and co.)
Diffstat (limited to 'docs')
0 files changed, 0 insertions, 0 deletions