Prevent csv/xls injection (#429)

docs/reference/symfony.rst

@@ -46,6 +46,7 @@ This service can be configured throught the following parameters:
 * ``sonata.exporter.writer.csv.escape``: defaults to ``\\``
 * ``sonata.exporter.writer.csv.show_headers``: defaults to ``true``
 * ``sonata.exporter.writer.csv.with_bom``: defaults to ``false``
+* ``sonata.exporter.writer.csv.safe_cells``: defaults to ``false``
 
 The JSON writer service
 ~~~~~~~~~~~~~~~~~~~~~~~
@@ -60,6 +61,7 @@ This service can be configured throught the following parameters:
 
 * ``sonata.exporter.writer.xls.filename``: defaults to ``php://output``
 * ``sonata.exporter.writer.xls.show_headers``: defaults to ``true``
+* ``sonata.exporter.writer.xls.safe_cells``: defaults to ``false``
 
 The XML writer service
 ~~~~~~~~~~~~~~~~~~~~~~~

src/Bridge/Symfony/DependencyInjection/Configuration.php

@@ -69,6 +69,10 @@ public function getConfigTreeBuilder(): TreeBuilder
                                     ->defaultValue(false)
                                     ->info('include the byte order mark')
                                 ->end()
+                                ->booleanNode('safe_cells')
+                                    ->defaultValue(false)
+                                    ->info('escapes data cells that that may be interpreted as formulas in spreadsheet software')
+                                ->end()
                             ->end()
                         ->end()
                         ->arrayNode('json')
@@ -91,6 +95,10 @@ public function getConfigTreeBuilder(): TreeBuilder
                                     ->defaultValue(true)
                                     ->info('add column names as the first line')
                                 ->end()
+                                ->booleanNode('safe_cells')
+                                    ->defaultValue(false)
+                                    ->info('escapes data cells that that may be interpreted as formulas in spreadsheet software')
+                                ->end()
                             ->end()
                         ->end()
                         ->arrayNode('xml')

src/Bridge/Symfony/Resources/config/services.xml

@@ -8,13 +8,15 @@
             <argument>%sonata.exporter.writer.csv.escape%</argument>
             <argument>%sonata.exporter.writer.csv.show_headers%</argument>
             <argument>%sonata.exporter.writer.csv.with_bom%</argument>
+            <argument>%sonata.exporter.writer.csv.safe_cells%</argument>
         </service>
         <service id="sonata.exporter.writer.json" class="Sonata\Exporter\Writer\JsonWriter" public="false">
             <argument>%sonata.exporter.writer.json.filename%</argument>
         </service>
         <service id="sonata.exporter.writer.xls" class="Sonata\Exporter\Writer\XlsWriter" public="false">
             <argument>%sonata.exporter.writer.xls.filename%</argument>
             <argument>%sonata.exporter.writer.xls.show_headers%</argument>
+            <argument>%sonata.exporter.writer.xls.safe_cells%</argument>
         </service>
         <service id="sonata.exporter.writer.xml" class="Sonata\Exporter\Writer\XmlWriter" public="false">
             <argument>%sonata.exporter.writer.xml.filename%</argument>

src/Writer/CsvWriter.php

@@ -65,6 +65,11 @@ final class CsvWriter implements TypedWriterInterface
      */
     private $terminate;
 
+    /**
+     * @var bool
+     */
+    private $safeCells;
+
     /**
      * @throws \RuntimeException
      */
@@ -75,7 +80,8 @@ public function __construct(
         string $escape = '\\',
         bool $showHeaders = true,
         bool $withBom = false,
-        string $terminate = "\n"
+        string $terminate = "\n",
+        bool $safeCells = false
     ) {
         $this->filename = $filename;
         $this->delimiter = $delimiter;
@@ -85,6 +91,7 @@ public function __construct(
         $this->terminate = $terminate;
         $this->position = 0;
         $this->withBom = $withBom;
+        $this->safeCells = $safeCells;
 
         if (is_file($filename)) {
             throw new \RuntimeException(sprintf('The file %s already exist', $filename));
@@ -137,6 +144,17 @@ public function write(array $data): void
             EXCEPTION);
         }
 
+        // prevent csv injection
+        if (true === $this->safeCells) {
+            foreach ($data as $key => $value) {
+                $data[$key] = preg_replace(
+                    ['/^=/', '/^\+/', '/^-/', '/^@/'],
+                    ['\'=', '\'+', '\'-', '\'@'],
+                    $value
+                );
+            }
+        }
+
         $result = @fputcsv($this->file, $data, $this->delimiter, $this->enclosure, $this->escape);
 
         if (!$result) {

src/Writer/XlsWriter.php

@@ -38,13 +38,19 @@ final class XlsWriter implements TypedWriterInterface
      */
     private $position = 0;
 
+    /**
+     * @var bool
+     */
+    private $safeCells;
+
     /**
      * @throws \RuntimeException
      */
-    public function __construct(string $filename, bool $showHeaders = true)
+    public function __construct(string $filename, bool $showHeaders = true, bool $safeCells = false)
     {
         $this->filename = $filename;
         $this->showHeaders = $showHeaders;
+        $this->safeCells = $safeCells;
 
         if (is_file($filename)) {
             throw new \RuntimeException(sprintf('The file %s already exists', $filename));
@@ -78,8 +84,19 @@ public function write(array $data): void
         $this->init($data);
 
         fwrite($this->file, '<tr>');
-        foreach ($data as $value) {
-            fwrite($this->file, sprintf('<td>%s</td>', $value));
+        // prevent xls injection
+        if (true === $this->safeCells) {
+            foreach ($data as $value) {
+                fwrite($this->file, sprintf('<td>%s</td>', preg_replace(
+                    ['/^=/', '/^\+/', '/^-/', '/^@/'],
+                    ['\'=', '\'+', '\'-', '\'@'],
+                    $value
+                )));
+            }
+        } else {
+            foreach ($data as $value) {
+                fwrite($this->file, sprintf('<td>%s</td>', $value));
+            }
         }
         fwrite($this->file, '</tr>');
 

tests/Bridge/Symfony/DependencyInjection/ConfigurationTest.php

@@ -42,13 +42,15 @@ public function testDefault(): void
                     'escape' => '\\',
                     'show_headers' => true,
                     'with_bom' => false,
+                    'safe_cells' => false,
                 ],
                 'json' => [
                     'filename' => 'php://output',
                 ],
                 'xls' => [
                     'filename' => 'php://output',
                     'show_headers' => true,
+                    'safe_cells' => false,
                 ],
                 'xml' => [
                     'filename' => 'php://output',

tests/Bridge/Symfony/DependencyInjection/SonataExporterExtensionTest.php

@@ -34,9 +34,11 @@ public function testServiceParametersArePresent(): void
             'sonata.exporter.writer.csv.escape',
             'sonata.exporter.writer.csv.show_headers',
             'sonata.exporter.writer.csv.with_bom',
+            'sonata.exporter.writer.csv.safe_cells',
             'sonata.exporter.writer.json.filename',
             'sonata.exporter.writer.xls.filename',
             'sonata.exporter.writer.xls.show_headers',
+            'sonata.exporter.writer.xls.safe_cells',
             'sonata.exporter.writer.xml.filename',
             'sonata.exporter.writer.xml.main_element',
             'sonata.exporter.writer.xml.child_element',