fix: resolve issue with csv injection option

Author: mrodrig

README.md

@@ -197,7 +197,7 @@ Returns the CSV `string` or rejects with an `Error` if there was an issue.
     * Note: If selected, values will be converted using `toLocaleString()` rather than `toString()`
   * `wrapBooleans` - Boolean - Should boolean values be wrapped in wrap delimiters to prevent Excel from converting them to Excel's TRUE/FALSE Boolean values.
     * Default: `false`
-  * `preventCsvInjection` - Boolean - Should CSV injection be prevented by left trimming these characters: Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D).
+  * `preventCsvInjection` - Boolean - Should CSV injection be prevented by left trimming these characters, including when they appear after leading spaces: Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D).
     * Default: `false`
 
 
@@ -324,4 +324,4 @@ $ npm run coverage
 	* `json2csv test.json -o output.csv -W -k arrayOfStrings -o output.csv`
 * Empty field value option (as of 3.1.0)
 * TypeScript typings included (as of 3.4.0) - thanks to [@GabrielCastro](https://github.com/GabrielCastro)!
-* Synchronous use case support (as of 5.0.0) - thanks to [@Nokel81](https://github.com/Nokel81)
+* Synchronous use case support (as of 5.0.0) - thanks to [@Nokel81](https://github.com/Nokel81)

src/json2csv.ts

@@ -407,7 +407,7 @@ export const Json2Csv = function (options: DefaultJson2CsvOptions) {
             if (Array.isArray(fieldValue)) {
                 return fieldValue.map(preventCsvInjection);
             } else if (typeof fieldValue === 'string' && !utils.isNumber(fieldValue)) {
-                return fieldValue.replace(/^[=+\-@\t\r]+/g, '');
+                return fieldValue.replace(/^[ \t\r]*[=+\-@\t\r]+/g, '');
             }
             return fieldValue;
         }

src/types.ts

@@ -57,7 +57,8 @@ interface SharedConverterOptions {
 
   /**
    * Should CSV injection be prevented by left trimming these characters:
-   * Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D).
+   * Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D),
+   * including when they appear after leading spaces.
    * @default false
    */
   preventCsvInjection?: boolean;

test/json2csv.ts

@@ -721,6 +721,26 @@ export function runTests() {
                 assert.equal(csv, expectedCsv);
             });
 
+            it('should left trim csv injection characters after leading whitespace if preventCsvInjection is specified', () => {
+                const csv = json2csv([{ name: '   =SUM(B1:B2)' }], {
+                    preventCsvInjection: true
+                });
+
+                const expectedCsv = 'name\nSUM(B1:B2)';
+
+                assert.equal(csv, expectedCsv);
+            });
+
+            it('should not left trim leading spaces without csv injection characters if preventCsvInjection is specified', () => {
+                const csv = json2csv([{ name: '   Bob' }], {
+                    preventCsvInjection: true
+                });
+
+                const expectedCsv = 'name\n   Bob';
+
+                assert.equal(csv, expectedCsv);
+            });
+
             it('should not alter numbers by removing minus (-) even if preventCsvInjection is specified', () => {
                 const csv = json2csv([{ temperature: -10 }], {
                     preventCsvInjection: true