csv-stringify - npm Package Compare versions

Comparing version 6.2.4 to 6.3.0

dist/esm/index.d.ts

@@ -108,2 +108,6 @@ /// <reference types="node" />
     record_delimiter?: RecordDelimiter
+    /**
+     * Boolean, default to false, if true, fields that begin with `=`, `+`, `-`, `@`, `\t`, or `\r` will be prepended with a `'` to protected agains csv injection attacks
+     */
+    escape_formulas?: boolean
 }
@@ -110,0 +114,0 @@

lib/api/index.js

@@ -128,3 +128,3 @@
         }
-        const {delimiter, escape, quote, quoted, quoted_empty, quoted_string, quoted_match, record_delimiter} = options;
+        const {delimiter, escape, quote, quoted, quoted_empty, quoted_string, quoted_match, record_delimiter, escape_formulas} = options;
         if('' === value && '' === field){
@@ -162,2 +162,5 @@ let quotedMatch = quoted_match && quoted_match.filter(quoted_match => {
           quotedMatch = quotedMatch && quotedMatch.length > 0;
+          if (escape_formulas && ['=', '+', '-', '@', '\t', '\r'].includes(value[0])) {
+            value = `'${value}`;
+          }
           const shouldQuote = containsQuote === true || containsdelimiter || containsRecordDelimiter || quoted || quotedString || quotedMatch;
@@ -164,0 +167,0 @@ if(shouldQuote === true && containsEscape === true){

lib/api/normalize_options.js

@@ -53,2 +53,11 @@
   }
+  // Normalize option `escape_formulas`
+  if(options.escape_formulas === undefined || options.escape_formulas === null){
+    options.escape_formulas = false;
+  }else if(typeof options.escape_formulas !== 'boolean'){
+    return [new CsvError('CSV_OPTION_ESCAPE_FORMULAS_INVALID_TYPE', [
+      'option `escape_formulas` must be a boolean,',
+      `got ${JSON.stringify(options.escape_formulas)}`
+    ])];
+  }
   // Normalize option `quoted_empty`
@@ -55,0 +64,0 @@ if(options.quoted_empty === undefined || options.quoted_empty === null){

lib/index.d.ts

@@ -108,2 +108,6 @@ /// <reference types="node" />
     record_delimiter?: RecordDelimiter
+    /**
+     * Boolean, default to false, if true, fields that begin with `=`, `+`, `-`, `@`, `\t`, or `\r` will be prepended with a `'` to protected agains csv injection attacks
+     */
+    escape_formulas?: boolean
 }
@@ -110,0 +114,0 @@

package.json

 {
-  "version": "6.2.4",
+  "version": "6.3.0",
   "name": "csv-stringify",
@@ -114,3 +114,3 @@ "description": "CSV stringifier implementing the Node.js `stream.Transform` API",
   },
-  "gitHead": "c55f5374569b39d16b1c2d131af7842d7e06c3ee"
+  "gitHead": "74d66082954b4f18b1f0f851dc5d43322c2f0db8"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

901706

increased by0.73%

Lines of code

24429

increased by0.53%

No dependency changes