docs(csv-stringify): escape formulas references

adaltas · May 9, 2023 · 62de1cf · 62de1cf
1 parent 1fc177c
commit 62de1cf
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/packages/csv-stringify/lib/api/index.js b/packages/csv-stringify/lib/api/index.js
@@ -158,6 +158,12 @@ const stringifier = function(options, state, info){
             }
           });
           quotedMatch = quotedMatch && quotedMatch.length > 0;
+          // See https://github.com/adaltas/node-csv/pull/387
+          // More about CSV injection or formula injection, when websites embed
+          // untrusted input inside CSV files:
+          // https://owasp.org/www-community/attacks/CSV_Injection
+          // http://georgemauer.net/2017/10/07/csv-injection.html
+          // Apple Numbers unicode normalization is empirical from testing
           if (escape_formulas) {
             switch (value[0]) {
             case '=':