Allow escaping of excel formulas
Open
- Dominant language
- Python
- Stars
- 4.8k
- Forks
- 617
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
Packages that leverage this app like django-tablib allows us to export user submitted data.
This exposes a potential security issue where users can add excel formulas to certain exported fields.
Excel allows us to use ``'`` at the beginning of any cell value to have it treated as text only and thus not execute any formula.
I did some digging and looks like this feature is not supported.
I'm interested in contributing this but I'm not 100% sure exactly where, is this something that should go on the packaged dependencies?
Contributor guide
Assessment
This issue has not been assessed yet.