viscous/espocrm
1
0
Fork 0
mirror of https://github.com/espocrm/espocrm.git synced 2026-06-29 07:26:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve sanitize CSV

Browse Source
This commit is contained in:
Yurii
2026-06-10 20:50:30 +03:00
parent 67223bfb82
commit f209248efd
4 changed files with 61 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
application/Espo/Tools/Export/Format/Csv/Processor.php
View File

@@ -37,6 +37,7 @@ use Espo\Tools\Export\Collection;
use Espo\Tools\Export\Processor as ProcessorInterface;
use Espo\Tools\Export\Processor\Params;
use Espo\Tools\Export\Processor\Util;
use Psr\Http\Message\StreamInterface;
use GuzzleHttp\Psr7\Stream;
@@ -98,26 +99,9 @@ class Processor implements ProcessorInterface
$value = (string) $value;
$preparedRow[] = $this->sanitizeCellValue($value);
$preparedRow[] = Util::sanitizeCellValue($value);
}
return $preparedRow;
}
private function sanitizeCellValue(string $value): string
{
if ($value === '') {
return $value;
}
if (is_numeric($value)) {
return $value;
}
if (in_array($value[0], ['+', '-', '@', '='])) {
return "'" . $value;
}
return $value;
}
}

20
application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php
View File

@@ -43,6 +43,7 @@ use Espo\Tools\Export\Format\CellValuePreparatorFactory;
use Espo\Tools\Export\Processor as ProcessorInterface;
use Espo\Tools\Export\Processor\Params;
use Espo\Tools\Export\Processor\Util;
use GuzzleHttp\Psr7\Stream;
use LogicException;
use OpenSpout\Common\Entity\Cell;
@@ -174,7 +175,7 @@ class OpenSpoutProcessor implements ProcessorInterface
->prepare($entity, $name);
if (is_string($value)) {
$value = $this->sanitizeCellValue($value);
$value = Util::sanitizeCellValue($value);
return Cell\StringCell::fromValue($value);
}
@@ -275,21 +276,4 @@ class OpenSpoutProcessor implements ProcessorInterface
return '[$' . $currencySymbol . '-409]#,##0.00;-[$' . $currencySymbol . '-409]#,##0.00';
}
private function sanitizeCellValue(string $value): string
{
if ($value === '') {
return $value;
}
if (is_numeric($value)) {
return $value;
}
if (in_array($value[0], ['+', '-', '@', '='])) {
return "'" . $value;
}
return $value;
}
}

15
application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php
View File

@@ -49,6 +49,7 @@ use Espo\Tools\Export\Format\CellValuePreparatorFactory;
use Espo\Tools\Export\Processor as ProcessorInterface;
use Espo\Tools\Export\Processor\Params;
use Espo\Tools\Export\Processor\Util;
use Psr\Http\Message\StreamInterface;
use GuzzleHttp\Psr7\Stream;
@@ -625,19 +626,7 @@ class PhpSpreadsheetProcessor implements ProcessorInterface
return $value;
}
if ($value === '') {
return $value;
}
if (is_numeric($value)) {
return $value;
}
if (in_array($value[0], ['+', '-', '@', '='])) {
return "'" . $value;
}
return $value;
return Util::sanitizeCellValue($value);
}
private function sanitizeUrl(string $value): ?string

55
application/Espo/Tools/Export/Processor/Util.php Normal file
View File

@@ -0,0 +1,55 @@
<?php
/************************************************************************
* This file is part of EspoCRM.
*
* EspoCRM – Open Source CRM application.
* Copyright (C) 2014-2026 EspoCRM, Inc.
* Website: https://www.espocrm.com
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* The interactive user interfaces in modified source and object code versions
* of this program must display Appropriate Legal Notices, as required under
* Section 5 of the GNU Affero General Public License version 3.
*
* In accordance with Section 7(b) of the GNU Affero General Public License version 3,
* these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
************************************************************************/
namespace Espo\Tools\Export\Processor;
/**
* @internal
*/
class Util
{
public static function sanitizeCellValue(string $value): string
{
if ($value === '') {
return $value;
}
if (is_numeric($value)) {
return $value;
}
$trimmed = ltrim($value, " \t\r\n\v\0");
if ($trimmed !== '' && in_array($trimmed[0], ['+', '-', '@', '='])) {
return "'" . $value;
}
return $value;
}
}