19 lines
882 B
TypeScript
19 lines
882 B
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import { objectsToCsv, rowsToCsv, rowsToSpreadsheetSafeCsv } from '../../src/exports/csv-export';
|
|
|
|
describe('CSV export security', () => {
|
|
it('preserves formula-like source values for internal serialization', () => {
|
|
expect(rowsToCsv([['=1+1', '+cmd', '-2', '@name']])).toBe('=1+1;+cmd;-2;@name');
|
|
});
|
|
|
|
it('neutralizes formula-like values in spreadsheet-facing exports', () => {
|
|
expect(rowsToSpreadsheetSafeCsv([['=1+1', ' +cmd', '-2', '@name', 'plain']]))
|
|
.toBe("\"'=1+1\";\"' +cmd\";\"'-2\";\"'@name\";plain");
|
|
});
|
|
|
|
it('uses the configured delimiter and protects object exports', () => {
|
|
expect(rowsToCsv([['a,b', 'c']], ',')).toBe('"a,b",c');
|
|
expect(objectsToCsv([{ finding: '=HYPERLINK("https://example.invalid")' }]))
|
|
.toBe('finding\n"\'=HYPERLINK(""https://example.invalid"")"');
|
|
});
|
|
}); |