Merge pull request #285 from mrodrig/fix-csv-injection-patch

Fix csv injection patch

Author: mrodrig

.github/workflows/automated-tests-workflow.yml

@@ -9,7 +9,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        node: [18, 20, 22]
+        node: [20, 22, 24]
 
     steps:
       - uses: actions/checkout@v3

README.md

@@ -197,7 +197,7 @@ Returns the CSV `string` or rejects with an `Error` if there was an issue.
     * Note: If selected, values will be converted using `toLocaleString()` rather than `toString()`
   * `wrapBooleans` - Boolean - Should boolean values be wrapped in wrap delimiters to prevent Excel from converting them to Excel's TRUE/FALSE Boolean values.
     * Default: `false`
-  * `preventCsvInjection` - Boolean - Should CSV injection be prevented by left trimming these characters: Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D).
+  * `preventCsvInjection` - Boolean - Should CSV injection be prevented by left trimming these characters, including when they appear after leading spaces: Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D).
     * Default: `false`
 
 
@@ -324,4 +324,4 @@ $ npm run coverage
 	* `json2csv test.json -o output.csv -W -k arrayOfStrings -o output.csv`
 * Empty field value option (as of 3.1.0)
 * TypeScript typings included (as of 3.4.0) - thanks to [@GabrielCastro](https://github.com/GabrielCastro)!
-* Synchronous use case support (as of 5.0.0) - thanks to [@Nokel81](https://github.com/Nokel81)
+* Synchronous use case support (as of 5.0.0) - thanks to [@Nokel81](https://github.com/Nokel81)

package-lock.json

@@ -5,7 +5,7 @@
     },
     "name": "json-2-csv",
     "description": "A JSON to CSV and CSV to JSON converter that natively supports sub-documents and auto-generates the CSV heading.",
-    "version": "5.5.10",
+    "version": "5.5.11",
     "homepage": "https://mrodrig.github.io/json-2-csv",
     "repository": {
         "type": "git",
@@ -40,8 +40,8 @@
         "cli"
     ],
     "dependencies": {
-        "deeks": "3.1.0",
-        "doc-path": "4.1.1"
+        "deeks": "3.2.1",
+        "doc-path": "4.1.4"
     },
     "devDependencies": {
         "@types/mocha": "10.0.1",
@@ -60,4 +60,4 @@
         "node": ">= 16"
     },
     "license": "MIT"
-}
+}

package.json

@@ -407,7 +407,7 @@ export const Json2Csv = function (options: DefaultJson2CsvOptions) {
             if (Array.isArray(fieldValue)) {
                 return fieldValue.map(preventCsvInjection);
             } else if (typeof fieldValue === 'string' && !utils.isNumber(fieldValue)) {
-                return fieldValue.replace(/^[=+\-@\t\r]+/g, '');
+                return fieldValue.replace(/^[ \t\r]*[=+\-@\t\r]+/g, '');
             }
             return fieldValue;
         }

src/json2csv.ts

@@ -57,7 +57,8 @@ interface SharedConverterOptions {
 
   /**
    * Should CSV injection be prevented by left trimming these characters:
-   * Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D).
+   * Equals (=), Plus (+), Minus (-), At (@), Tab (0x09), Carriage return (0x0D),
+   * including when they appear after leading spaces.
    * @default false
    */
   preventCsvInjection?: boolean;