@woocommerce/csv-export - npm Package Compare versions

Comparing version 1.7.0 to 1.8.0

build-module/__mocks__/mock-csv-data.js

 export default `Date,Orders,Description,"Total sales",Refunds,Coupons,Taxes,Shipping,"Net sales","Negative number"
-2018-04-29T00:00:00,30,"Lorem, ""ipsum""",200,19,19,100,19,200,"\t-123"`;
[phone]T00:00:00,30,"Lorem, ""ipsum""",200,19,19,100,19,200,"'-123"`;

build-module/index.js

@@ -9,6 +9,13 @@ /**
     // Prevent CSV injection.
-    // See: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/
+    // See: https://owasp.org/www-community/attacks/CSV_Injection
     // See: WC_CSV_Exporter::escape_data()
-    if (['=', '+', '-', '@'].includes(stringValue.charAt(0))) {
-        stringValue = '"\t' + stringValue + '"';
+    if ([
+        '=',
+        '+',
+        '-',
+        '@',
+        String.fromCharCode(0x09),
+        String.fromCharCode(0x0d), // carriage return
+    ].includes(stringValue.charAt(0))) {
+        stringValue = '"\'' + stringValue + '"';
     }
@@ -15,0 +22,0 @@ else if (stringValue.match(/[,"\s]/)) {

build-types/__mocks__/mock-csv-data.d.ts

@@ -1,3 +0,3 @@
-declare var _default: "Date,Orders,Description,\"Total sales\",Refunds,Coupons,Taxes,Shipping,\"Net sales\",\"Negative number\"\n2018-04-29T00:00:00,30,\"Lorem, \"\"ipsum\"\"\",200,19,19,100,19,200,\"\t-123\"";
+declare const _default: "Date,Orders,Description,\"Total sales\",Refunds,Coupons,Taxes,Shipping,\"Net sales\",\"Negative number\"\n2018-04-29T00:00:00,30,\"Lorem, \"\"ipsum\"\"\",200,19,19,100,19,200,\"'-123\"";
 export default _default;
 //# sourceMappingURL=mock-csv-data.d.ts.map

build-types/__mocks__/mock-headers.d.ts

@@ -1,2 +0,2 @@
-declare var _default: {
+declare const _default: {
     label: string;
@@ -3,0 +3,0 @@ key: string;

build-types/__mocks__/mock-rows.d.ts

@@ -1,2 +0,2 @@
-declare var _default: ({
+declare const _default: ({
     display: string;
@@ -3,0 +3,0 @@ value: string;

build-types/index.d.ts

@@ -1,10 +0,10 @@
-export declare type Header = {
+export type Header = {
     label: string;
     key: string;
 };
-export declare type RowItem = {
+export type RowItem = {
     display: string;
     value: string | number;
 };
-export declare type Rows = Array<RowItem[]>;
+export type Rows = Array<RowItem[]>;
 /**
@@ -11,0 +11,0 @@ * Generates a CSV string from table contents

build/__mocks__/mock-csv-data.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = `Date,Orders,Description,"Total sales",Refunds,Coupons,Taxes,Shipping,"Net sales","Negative number"
-2018-04-29T00:00:00,30,"Lorem, ""ipsum""",200,19,19,100,19,200,"\t-123"`;
[phone]T00:00:00,30,"Lorem, ""ipsum""",200,19,19,100,19,200,"'-123"`;

build/index.js

@@ -15,6 +15,13 @@ "use strict";
     // Prevent CSV injection.
-    // See: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/
+    // See: https://owasp.org/www-community/attacks/CSV_Injection
     // See: WC_CSV_Exporter::escape_data()
-    if (['=', '+', '-', '@'].includes(stringValue.charAt(0))) {
-        stringValue = '"\t' + stringValue + '"';
+    if ([
+        '=',
+        '+',
+        '-',
+        '@',
+        String.fromCharCode(0x09),
+        String.fromCharCode(0x0d), // carriage return
+    ].includes(stringValue.charAt(0))) {
+        stringValue = '"\'' + stringValue + '"';
     }
@@ -21,0 +28,0 @@ else if (stringValue.match(/[,"\s]/)) {

CHANGELOG.md

@@ -5,7 +5,23 @@ # Changelog
 
-## [1.7.0](https://www.npmjs.com/package/@woocommerce/packages/js/csv-export/v/1.7.0) - 2022-07-08 
+## [1.8.0](https://www.npmjs.com/package/@woocommerce/csv-export/v/1.8.0) - 2023-11-23 
 
+-   Patch - Use single quote instead of tab for escaping in CSV exports. [#41163]
+-   Patch - Add missing type definitions and add babel config for tests [#34428]
+-   Minor - Adjust build/test scripts to remove -- -- that was required for pnpm 6. [#34661]
+-   Minor - Fix node and pnpm versions via engines [#34773]
+-   Patch - Make eslint emit JSON report for annotating PRs. [#39704]
+-   Minor - Match TypeScript version with syncpack [#34787]
+-   Patch - Merging trunk with local [#34322]
+-   Patch - Update eslint to 8.32.0 across the monorepo. [#36700]
+-   Minor - Update pnpm monorepo-wide to 8.6.5 [#38990]
+-   Minor - Update pnpm to 8.6.7 [#39245]
+-   Minor - Update pnpm to version 8. [#37915]
+-   Minor - Update pnpm version constraint to 7.13.3 to avoid auto-install-peers issues [#35007]
+-   Minor - Upgrade TypeScript to 5.1.6 [#39531]
+
+## [1.7.0](https://www.npmjs.com/package/@woocommerce/csv-export/v/1.7.0) - 2022-07-08 
+
 -   Minor - Remove PHP and Composer dependencies for packaged JS packages
 
-## [1.6.0](https://www.npmjs.com/package/@woocommerce/packages/js/csv-export/v/1.6.0) - 2022-06-14 
+## [1.6.0](https://www.npmjs.com/package/@woocommerce/csv-export/v/1.6.0) - 2022-06-14 
 
@@ -12,0 +28,0 @@ -   Minor - Add Jetpack Changelogger

composer.json

@@ -8,3 +8,3 @@ {
 	"require-dev": {
-		"automattic/jetpack-changelogger": "3.1.3"
+		"automattic/jetpack-changelogger": "3.3.0"
 	},
@@ -11,0 +11,0 @@ "config": {

jest.config.json

 {
 	"rootDir": "./src",
-	"preset": "../../internal-js-tests/jest.config.js"
+	"preset": "../node_modules/@woocommerce/internal-js-tests/jest-preset.js"
 }

package.json

 {
   "name": "@woocommerce/csv-export",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "WooCommerce utility library to convert data to CSV files.",
   "author": "Automattic",
   "license": "GPL-3.0-or-later",
+  "engines": {
+    "node": "^16.14.1",
+    "pnpm": "^8.6.7"
+  },
   "keywords": [
@@ -25,2 +29,3 @@ "wordpress",
   "dependencies": {
+    "@types/node": "^16.18.18",
     "browser-filesaver": "^1.1.1",
@@ -34,10 +39,12 @@ "moment": "^2.29.1"
     "@babel/core": "^7.17.5",
-    "@woocommerce/eslint-plugin": "2.2.0",
-    "eslint": "^8.12.0",
+    "@types/jest": "^27.4.1",
+    "eslint": "^8.32.0",
     "jest": "^27.5.1",
     "jest-cli": "^27.5.1",
-    "require-turbo": "0.0.0",
+    "concurrently": "^7.0.0",
     "rimraf": "^3.0.2",
     "ts-jest": "^27.1.3",
-    "typescript": "^4.6.2"
+    "typescript": "^5.1.6",
+    "@woocommerce/eslint-plugin": "2.2.0",
+    "@woocommerce/internal-js-tests": "1.1.0"
   },
@@ -51,12 +58,14 @@ "lint-staged": {
   "scripts": {
+    "turbo:build": "tsc --project tsconfig.json && tsc --project tsconfig-cjs.json",
+    "turbo:test": "jest --config ./jest.config.json",
     "changelog": "composer exec -- changelogger",
     "clean": "pnpm exec rimraf tsconfig.tsbuildinfo build build-*",
-    "build": "node ./node_modules/require-turbo && tsc --build ./tsconfig.json ./tsconfig-cjs.json",
-    "start": "tsc --build --watch",
-    "lint": "node ./node_modules/require-turbo && eslint src",
+    "build": "pnpm -w exec turbo run turbo:build --filter=$npm_package_name",
+    "test": "pnpm test:js",
+    "test:js": "pnpm -w exec turbo run turbo:test --filter=$npm_package_name",
+    "lint": "eslint src",
+    "start": "concurrently \"tsc --project tsconfig.json --watch\" \"tsc --project tsconfig-cjs.json --watch\"",
     "lint:fix": "eslint src --fix",
-    "test": "node ./node_modules/require-turbo && jest --config ./jest.config.json",
     "test-staged": "jest --bail --config ./jest.config.json --findRelatedTests"
-  },
-  "readme": "# CSV Export\n\nA set of functions to convert data into CSV values, and enable a browser download of the CSV data.\n\n## Installation\n\nInstall the module\n\n```bash\npnpm install @woocommerce/csv-export --save\n```\n\n## Usage\n\n```js\nonClick = () => {\n\t// Create a file name based on a title and optional query. Will return a timestamped\n\t// name, for example: revenue-2018-11-01-interval-month.csv\n\tconst name = generateCSVFileName( 'revenue', { interval: 'month' } );\n\n\t// Create a string of CSV data, `headers` is an array of row headers, put at the top\n\t// of the file. `rows` is a 2 dimensional array. Each array is a line in the file,\n\t// separated by newlines. The second-level arrays are the data points in each row.\n\t// For header format, see https://woocommerce.github.io/woocommerce-admin/#/components/table?id=headers-2\n\t// For rows format, see https://woocommerce.github.io/woocommerce-admin/#/components/table?id=rows-1\n\tconst data = generateCSVDataFromTable( headers, rows );\n\n\t// Triggers a browser UI to save a file, named the first argument, with the contents of\n\t// the second argument.\n\tdownloadCSVFile( name, data );\n}\n```\n\n### generateCSVDataFromTable(headers, rows) ⇒ <code>String</code>\nGenerates a CSV string from table contents\n\n**Returns**: <code>String</code> - Table contents in a CSV format\n\n| Param | Type | Description |\n| --- | --- | --- |\n| headers | <code>Array.&lt;Object&gt;</code> | Object with table header information |\n| rows | <code>Array.Array.&lt;Object&gt;</code> | Object with table rows information |\n\n### generateCSVFileName([name], [params]) ⇒ <code>String</code>\nGenerates a file name for CSV files based on the provided name, the current date\nand the provided params, which are all appended with hyphens.\n\n**Returns**: <code>String</code> - Formatted file name\n\n| Param | Type | Default | Description |\n| --- | --- | --- | --- |\n| [name] | <code>String</code> | <code>&#x27;&#x27;</code> | Name of the file |\n| [params] | <code>Object</code> | <code>{}</code> | Object of key-values to append to the file name |\n\n### downloadCSVFile(fileName, content)\nDownloads a CSV file with the given file name and contents\n\n| Param | Type | Description |\n| --- | --- | --- |\n| fileName | <code>String</code> | Name of the file to download |\n| content | <code>String</code> | Contents of the file to download |\n"
+  }
 }

src/__mocks__/mock-csv-data.js

 export default `Date,Orders,Description,"Total sales",Refunds,Coupons,Taxes,Shipping,"Net sales","Negative number"
-2018-04-29T00:00:00,30,"Lorem, ""ipsum""",200,19,19,100,19,200,"\t-123"`;
[phone]T00:00:00,30,"Lorem, ""ipsum""",200,19,19,100,19,200,"'-123"`;

src/index.ts

@@ -23,6 +23,15 @@ /**
 	// Prevent CSV injection.
-	// See: http://www.contextis.com/resources/blog/comma-separated-vulnerabilities/
+	// See: https://owasp.org/www-community/attacks/CSV_Injection
 	// See: WC_CSV_Exporter::escape_data()
-	if ( [ '=', '+', '-', '@' ].includes( stringValue.charAt( 0 ) ) ) {
-		stringValue = '"\t' + stringValue + '"';
+	if (
+		[
+			'=',
+			'+',
+			'-',
+			'@',
+			String.fromCharCode( 0x09 ), // tab
+			String.fromCharCode( 0x0d ), // carriage return
+		].includes( stringValue.charAt( 0 ) )
+	) {
+		stringValue = '"\'' + stringValue + '"';
 	} else if ( stringValue.match( /[,"\s]/ ) ) {
@@ -29,0 +38,0 @@ stringValue = '"' + stringValue.replace( /"/g, '""' ) + '"';

src/test/index.ts

@@ -36,5 +36,12 @@ /* eslint-disable jest/no-mocks-import */
 
-	it( 'should prefix tab character when the cell value starts with one of =, +, -, and @', () => {
-		[ '=', '+', '-', '@' ].forEach( ( val ) => {
-			const expected = 'value\n"\t' + val + 'test"';
+	it( 'should prefix single quote character when the cell value starts with one of =, +, -, @, tab, and carriage return', () => {
+		[
+			'=',
+			'+',
+			'-',
+			'@',
+			String.fromCharCode( 0x09 ), // tab
+			String.fromCharCode( 0x0d ), // carriage return
+		].forEach( ( val ) => {
+			const expected = 'value\n"\'' + val + 'test"';
 			const result = generateCSVDataFromTable(
@@ -41,0 +48,0 @@ [

tsconfig-cjs.json

 {
 	"extends": "../tsconfig-cjs",
 	"compilerOptions": {
-		"outDir": "build"
+		"outDir": "build",
+		"typeRoots": [
+			"./typings",
+			"./node_modules/@types"
+		]
 	}
 }

tsconfig.json

@@ -9,4 +9,7 @@ {
 		"declarationDir": "./build-types",
-		"composite": true
+		"typeRoots": [
+			"./typings",
+			"./node_modules/@types"
+		]
 	}
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Lines of code

808

increased by5.48%

Worsened metrics

Total package byte prevSize

46588

decreased by-81.48%

Dependency count

3

increased by50%

Dev dependency count

11

increased by22.22%

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• + Added@types/node@^16.18.18

• + Added@types/node@16.18.119(transitive)