Formula Injections using crafted referrer on CSV export

There is a minor security issue in the current version of Dolomon that can be used as a vector for social engineering.

How to reproduce

• user A creates a dolo and shares it publicly
• user B access the link using a crafted referrer containing a malicious formula, for example =1+1
• user A exports the dolo data in CSV
• user A opens referrers.csv. As the CSV file comes from a trusted source, the user can more easily ignore the warning of the spreadsheet and allow the malicious formula to be executed

Note: It is very easy to spoof the referrer, for example using wget --referer="=1+1" DOLOMON_URL/h/XXX

How to fix

During CSV export, referrer stings should be sanitized properly by adding a 'character at the beginning if one is starting by =, +, - or @.

Reference: https://www.contextis.com/resources/blog/comma-separated-vulnerabilities/