You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
escape_formulas indiscriminately adds ' to all fields with the @escape_formula_start values of ["=", "-", "+", "@"] which is great and follows the OWASP guidance, except...
Negative numbers are real and this causes huge problems with round-tripping negative numbers.
There is no risk posed by data that has a - in front that is stored in Elixir as any numeric type-- the risk is data destruction in cases where non-numeric data starts with a -.
Open questions
Can we skip based on type before coercing to string or is it better to ask for columns to skip?
The text was updated successfully, but these errors were encountered:
If this is a feature request, why do we need it?
escape_formulas
indiscriminately adds'
to all fields with the@escape_formula_start
values of["=", "-", "+", "@"]
which is great and follows the OWASP guidance, except...-
in front that is stored in Elixir as any numeric type-- the risk is data destruction in cases where non-numeric data starts with a-
.Open questions
The text was updated successfully, but these errors were encountered: