wip

Author: jasonvarga

src/Forms/Exporters/CsvExporter.php

@@ -2,6 +2,7 @@
 
 namespace Statamic\Forms\Exporters;
 
+use League\Csv\EscapeFormula;
 use League\Csv\Writer;
 use SplTempFileObject;
 use Statamic\Support\Arr;
@@ -15,6 +16,7 @@ public function export(): string
     {
         $this->writer = Writer::createFromFileObject(new SplTempFileObject);
         $this->writer->setDelimiter(Arr::get($this->config, 'delimiter', config('statamic.forms.csv_delimiter', ',')));
+        $this->writer->addFormatter(new EscapeFormula);
 
         $this->insertHeaders();
 

tests/Forms/CsvExporterTest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Forms;
+
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Blueprint;
+use Statamic\Facades\Form;
+use Statamic\Facades\FormSubmission;
+use Statamic\Forms\Exporters\CsvExporter;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class CsvExporterTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk;
+
+    #[Test]
+    public function it_neutralizes_formula_injection_in_submission_values()
+    {
+        $blueprint = Blueprint::makeFromFields(['name' => ['type' => 'text']]);
+        Blueprint::shouldReceive('find')->with('forms.test')->andReturn($blueprint);
+
+        $form = tap(Form::make('test'))->save();
+        FormSubmission::make()->form($form)->data(['name' => '=1+1'])->save();
+
+        $csv = (new CsvExporter)->setForm($form)->setConfig([])->export();
+
+        $this->assertStringContainsString('\'=1+1', $csv);
+        $this->assertStringNotContainsString('"=1+1', $csv);
+    }
+}