[DataGrid] Do not miss to escape formulas in CSV export (#13888)

mui · Jul 22, 2024 · caff80a · caff80a
1 parent 9d1713e
commit caff80a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 11 deletions.
diff --git a/packages/x-data-grid/src/hooks/features/export/serializers/csvSerializer.ts b/packages/x-data-grid/src/hooks/features/export/serializers/csvSerializer.ts
@@ -10,16 +10,16 @@ function sanitizeCellValue(value: unknown, csvOptions: CSVOptions): string {
 
   if (csvOptions.shouldAppendQuotes || csvOptions.escapeFormulas) {
     const escapedValue = valueStr.replace(/"/g, '""');
-    // Make sure value containing delimiter or line break won't be split into multiple cells
-    if ([csvOptions.delimiter, '\n', '\r', '"'].some((delimiter) => valueStr.includes(delimiter))) {
-      return `"${escapedValue}"`;
-    }
     if (csvOptions.escapeFormulas) {
       // See https://owasp.org/www-community/attacks/CSV_Injection
       if (['=', '+', '-', '@', '\t', '\r'].includes(escapedValue[0])) {
-        return `'${escapedValue}`;
+        return `"'${escapedValue}"`;
       }
     }
+    // Make sure value containing delimiter or line break won't be split into multiple cells
+    if ([csvOptions.delimiter, '\n', '\r', '"'].some((delimiter) => valueStr.includes(delimiter))) {
+      return `"${escapedValue}"`;
+    }
     return escapedValue;
   }
 

diff --git a/packages/x-data-grid/src/tests/export.DataGrid.test.tsx b/packages/x-data-grid/src/tests/export.DataGrid.test.tsx
@@ -106,12 +106,12 @@ describe('<DataGrid /> - Export', () => {
       expect(csv).to.equal(
         [
           'name',
-          "'=1+1",
-          "'+1+1",
-          "'-1+1",
-          "'@1+1",
-          "'\t1+1",
-          '"\r1+1"',
+          '"\'=1+1"',
+          '"\'+1+1"',
+          '"\'-1+1"',
+          '"\'@1+1"',
+          '"\'\t1+1"',
+          '"\'\r1+1"',
           '",=1+1"',
           '"value,=1+1"',
         ].join('\r\n'),