Skip to content

fix(storage): export untrusted spreadsheet text as literal values - #972

Open
saksim wants to merge 1 commit into
NanmiCoder:mainfrom
saksim:codex/upstream-spreadsheet-formulas
Open

saksim wants to merge 1 commit into
NanmiCoder:mainfrom
saksim:codex/upstream-spreadsheet-formulas

Conversation

@saksim

@saksim saksim commented Sep 9, 2026

Copy link
Copy Markdown

Content beginning with formula prefixes can be interpreted by spreadsheet applications when CSV/Excel exports are opened. Prefix dangerous CSV string values with an apostrophe and explicitly write Excel strings as text cells, while retaining actual numeric values.

This PR only changes formula handling. It does not include the concurrent file transaction or column mapping changes. The CSV helper is applied directly to the original async writer so this branch is independently based on upstream main.

Validation: all 12 new tests fail before the fix. This isolated branch passes all 108 tests (Python 3.11, Windows with PYTHONUTF8=1). Seven CSV prefixes and five Excel sheet types are tested; saved workbooks are reopened to verify string/numeric cell types. No external formula is executed.

CSV raw values include the protective apostrophe; use JSON/JSONL when exact raw strings are required. Existing files are not repaired, and removing the escaping invalidates the protection. See docs/spreadsheet-formulas.md.

Fork tracking and CI: PR #21. Related report: saksim#5.

@saksim
saksim requested a review from NanmiCoder as a code owner September 9, 2026 03:14
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant