This project is archived. Its data is read-only.
Sanitize content to avoid Formula Injections on CSV export
During the export in CSV, user content should be sanitized properly by adding a `'`character if the cell is starting with one of the following characters: `=`, `+`, `-` or `@` . **How to reproduce:** - create a board - add a column title or a note with: `=1+1` - export to CSV - open it in a spreadsheet, the formula is interpreted in the spreadsheet Note: we can think that people will be able to notice malicious content when they see the board, but a attacker can "trick" users by masking suspicious content under other notes. **Reference:** https://www.contextis.com/resources/blog/comma-separated-vulnerabilities/
issue