Skip to content

Fix :escape_formula examples that ignore tabs and CRs #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
josevalim merged 1 commit into from
Sep 19, 2026
Merged

Fix :escape_formula examples that ignore tabs and CRs #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions lib/nimble_csv.ex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ defmodule NimbleCSV do
MyApp.CSV,
NimbleCSV.RFC4180.options()
|> Keyword.merge(
escape_formula: %{~w(@ + - = \\t \\r) => "'"},
escape_formula: %{["@", "+", "-", "=", "\t", "\r"] => "'"},
moduledoc: "RFC4180 with formula escaping"
)
)
Expand Down Expand Up @@ -234,7 +234,7 @@ defmodule NimbleCSV do
`:separator`, `:newlines`, and `:escape` characters above
* `:escape_formula` - an optional map of formula prefixes to escape sequences.
When `nil` (the default), formula escaping is disabled. For example,
`%{~w(@ + - = \t \r) => "'"}` escapes fields starting with `@`, `+`, `-`, `=`,
`%{["@", "+", "-", "=", "\t", "\r"] => "'"}` escapes fields starting with `@`, `+`, `-`, `=`,
tab, or carriage return by prefixing them with `'`

Although parsing may support multiple newline delimiters, when
Expand Down Expand Up @@ -264,7 +264,7 @@ defmodule NimbleCSV do
`@`, `+`, `-`, `=`, tab or carriage return). Use the following config to
follow the [OWASP recommendations](https://owasp.org/www-community/attacks/CSV_Injection):

escape_formula: %{~w(@ + - = \t \r) => "'"}
escape_formula: %{["@", "+", "-", "=", "\t", "\r"] => "'"}

Applications that want more control over this process, to allow formulas in specific
cases, or possibly minimize false positives, should leave this option disabled and
Expand Down
8 changes: 6 additions & 2 deletions test/nimble_csv_test.exs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ defmodule NimbleCSVTest do
DerivedParser,
CSV.options()
|> Keyword.merge(
escape_formula: %{~w(@ + - = \t \r) => "'"},
escape_formula: %{["@", "+", "-", "=", "\t", "\r"] => "'"},
moduledoc: "Test parser based on RFC4180"
)
)
Expand Down Expand Up @@ -517,7 +517,11 @@ defmodule NimbleCSVTest do
test_options = DerivedParser.options()
assert Keyword.get(test_options, :separator) == ","
assert Keyword.get(test_options, :escape) == "\""
assert Keyword.get(test_options, :escape_formula) == %{~w(@ + - = \t \r) => "'"}

assert Keyword.get(test_options, :escape_formula) == %{
["@", "+", "-", "=", "\t", "\r"] => "'"
}

assert Keyword.get(test_options, :moduledoc) == "Test parser based on RFC4180"

# Test that the new parser works
Expand Down