From ff17cfe3c2172770e07ac133506bdfcb19cee3f4 Mon Sep 17 00:00:00 2001 From: kidq330 Date: Fri, 18 Sep 2026 20:29:23 +0200 Subject: [PATCH] Fix `:escape_formula` examples that ignore tabs and CRs --- lib/nimble_csv.ex | 6 +++--- test/nimble_csv_test.exs | 8 ++++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/lib/nimble_csv.ex b/lib/nimble_csv.ex index 0a96347..e947772 100644 --- a/lib/nimble_csv.ex +++ b/lib/nimble_csv.ex @@ -104,7 +104,7 @@ defmodule NimbleCSV do MyApp.CSV, NimbleCSV.RFC4180.options() |> Keyword.merge( - escape_formula: %{~w(@ + - = \\t \\r) => "'"}, + escape_formula: %{["@", "+", "-", "=", "\t", "\r"] => "'"}, moduledoc: "RFC4180 with formula escaping" ) ) @@ -234,7 +234,7 @@ defmodule NimbleCSV do `:separator`, `:newlines`, and `:escape` characters above * `:escape_formula` - an optional map of formula prefixes to escape sequences. When `nil` (the default), formula escaping is disabled. For example, - `%{~w(@ + - = \t \r) => "'"}` escapes fields starting with `@`, `+`, `-`, `=`, + `%{["@", "+", "-", "=", "\t", "\r"] => "'"}` escapes fields starting with `@`, `+`, `-`, `=`, tab, or carriage return by prefixing them with `'` Although parsing may support multiple newline delimiters, when @@ -264,7 +264,7 @@ defmodule NimbleCSV do `@`, `+`, `-`, `=`, tab or carriage return). Use the following config to follow the [OWASP recommendations](https://owasp.org/www-community/attacks/CSV_Injection): - escape_formula: %{~w(@ + - = \t \r) => "'"} + escape_formula: %{["@", "+", "-", "=", "\t", "\r"] => "'"} Applications that want more control over this process, to allow formulas in specific cases, or possibly minimize false positives, should leave this option disabled and diff --git a/test/nimble_csv_test.exs b/test/nimble_csv_test.exs index 650c4f3..e81efb8 100644 --- a/test/nimble_csv_test.exs +++ b/test/nimble_csv_test.exs @@ -13,7 +13,7 @@ defmodule NimbleCSVTest do DerivedParser, CSV.options() |> Keyword.merge( - escape_formula: %{~w(@ + - = \t \r) => "'"}, + escape_formula: %{["@", "+", "-", "=", "\t", "\r"] => "'"}, moduledoc: "Test parser based on RFC4180" ) ) @@ -517,7 +517,11 @@ defmodule NimbleCSVTest do test_options = DerivedParser.options() assert Keyword.get(test_options, :separator) == "," assert Keyword.get(test_options, :escape) == "\"" - assert Keyword.get(test_options, :escape_formula) == %{~w(@ + - = \t \r) => "'"} + + assert Keyword.get(test_options, :escape_formula) == %{ + ["@", "+", "-", "=", "\t", "\r"] => "'" + } + assert Keyword.get(test_options, :moduledoc) == "Test parser based on RFC4180" # Test that the new parser works