CSV Injection

This is happening for this module as well. Here is a patch that strips the characters '=', '+', '-', or '@' from the beginning of any data cell before it gets exported, which prevents formulas from executing inside of a spreadsheet.

I changed this to use a different approach. It now uses a regular expression to add a space in front of the formula characters, rather than stripping them out.

Not sure this is working. I set a field value to be =SUM(1,3) and the CSV file had "=SUM(1,3)" for that column.

But, most importantly, this patch will only work when the output is a CSV file. There are other options with this module, such as XLSX, and this patch will actually alter the data in such a way that it will no longer be a valid XLSX file.

This patch will only work for CSV format, and for other formats like XLSX, it may cause the file to become invalid. If you're using the CSV Serialization module for exporting data, we can implement a patch there to address this issue, so that it will not affect the XLSX file.