`escape_formulas` should handle all [OWASP-designated formula prefixes](https://owasp.org/www-community/attacks/CSV_Injection).

1 files changed, 6 insertions, 2 deletions

diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb
index 8e55d0c5..f0345705 100644
--- a/lib/axlsx/workbook/worksheet/cell.rb
+++ b/lib/axlsx/workbook/worksheet/cell.rb
@@ -72,6 +72,10 @@ module Axlsx
     CELL_TYPES = [:date, :time, :float, :integer, :richtext,
                   :string, :boolean, :iso_8601, :text].freeze
 
+    # Leading characters that indicate a formula.
+    # See: https://owasp.org/www-community/attacks/CSV_Injection
+    FORMULA_PREFIXES = ['-', '=', '+', '@', '%', '|', "\r", "\t"].freeze
+
     # The index of the cellXfs item to be applied to this cell.
     # @return [Integer]
     # @see Axlsx::Styles
@@ -170,7 +174,7 @@ module Axlsx
         !is_text_run? &&          # No inline styles
         [email protected]? &&           # Not nil
         [email protected]? &&         # Not empty
-        [email protected]_with?(?=)  # Not a formula
+        [email protected]_with?(*FORMULA_PREFIXES) # Not a formula
     end
 
     # The inline font_name property for the cell
@@ -368,7 +372,7 @@ module Axlsx
     def is_formula?
       return false if escape_formulas
 
-      type == :string && @value.to_s.start_with?(?=)
+      type == :string && @value.to_s.start_with?(*FORMULA_PREFIXES)
     end
 
     def is_array_formula?