Commit b4d1a6ed authored by Felipe Artur's avatar Felipe Artur

Prevent prepending single quote to issue CSV exports

Only prepend single quote when unpermitted
symbols are at the beginning of the string.

Changelog: fixed
parent 4b88d6a1
......@@ -16,7 +16,7 @@
class CsvBuilder
DEFAULT_ORDER_BY = 'id'
DEFAULT_BATCH_SIZE = 1000
PREFIX_REGEX = /^[=\+\-@;]/.freeze
PREFIX_REGEX = /\A[=\+\-@;]/.freeze
attr_reader :rows_written
......
......@@ -105,5 +105,17 @@ RSpec.describe CsvBuilder do
expect(csv_data).not_to include "'*safe_desc"
expect(csv_data).not_to include "'*safe_title"
end
context 'when dangerous characters are after a line break' do
it 'does not append single quote to description' do
fake_object = double(title: "Safe title", description: "With task list\n-[x] todo 1")
fake_relation = FakeRelation.new([fake_object])
builder = described_class.new(fake_relation, 'Title' => 'title', 'Description' => 'description')
csv_data = builder.render
expect(csv_data).to eq("Title,Description\nSafe title,\"With task list\n-[x] todo 1\"\n")
end
end
end
end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment