Skip to content

Harden CSV output for spreadsheet use - #36

Draft
ryanduguid wants to merge 3 commits into
XeroAPI:mainfrom
ryanduguid:agent/harden-csv-output
Draft

Harden CSV output for spreadsheet use#36
ryanduguid wants to merge 3 commits into
XeroAPI:mainfrom
ryanduguid:agent/harden-csv-output

Conversation

@ryanduguid

@ryanduguid ryanduguid commented Aug 12, 2026

Copy link
Copy Markdown

Summary

Hardens CSV output for spreadsheet use without converting numeric amounts to text.

  • neutralises string cells and headers whose first non-whitespace character is =, +, - or @;
  • preserves leading spaces/tabs/newlines but places the apostrophe immediately before the formula character, so importer trimming cannot separate the defence from the dangerous prefix;
  • leaves numeric values, including negative amounts, numeric;
  • quotes fields containing bare carriage returns as well as line feeds;
  • covers all four formula prefixes after space, tab, CR and LF, signed string identifiers, headers, numeric negatives and CR-only records.

Verification at 35a10e7e9907604e8d7796a5bb3bca873b0943d1

  • npx vitest run test/lib/formatters.test.ts — 24 passed;
  • npm run build passed;
  • git diff --check passed.

…codes

Prefix CSV cells so spreadsheet applications treat exported values as data:
'=' is always neutralized with a leading apostrophe; '+', '-', and '@' are
neutralized only when the remainder is not purely alphanumeric, so benign
identifiers such as '-00123' round-trip byte-for-byte. Applies to both data
cells and headers. Also quotes values containing bare carriage returns.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant