Sanitize names to avoid Formula Injections on CSV export
During the export in CSV, names should be sanitized properly by adding a '
character if it's starting with a =
, +
, -
or @
.
How to reproduce: create a poll, add a response with the name =1+1
, export responses to CSV, open it in a spreadsheet.
Reference: https://www.contextis.com/resources/blog/comma-separated-vulnerabilities/