From 5d92e13d1824264d36bed2050d58e868e3a98d81 Mon Sep 17 00:00:00 2001
From: Patrick Lenk <dev@avatara.de>
Date: Wed, 11 Aug 2021 12:26:51 +0200
Subject: [PATCH] [TASK] Sanitize CSV and XLS frontend output export

---
 Resources/Private/Templates/Output/ExportCsv.html | 14 ++++++++------
 Resources/Private/Templates/Output/ExportXls.html |  4 ++--
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/Resources/Private/Templates/Output/ExportCsv.html b/Resources/Private/Templates/Output/ExportCsv.html
index e9f3c71c5..27fb339a8 100644
--- a/Resources/Private/Templates/Output/ExportCsv.html
+++ b/Resources/Private/Templates/Output/ExportCsv.html
@@ -22,15 +22,17 @@
 
 					<f:if condition="{vh:condition.isArray(val: '{answer.value}')}">
 						<f:else>
-							"<vh:string.removeQuote>{answer.value}</vh:string.removeQuote>";
+							"<vh:string.removeQuote><vh:string.sanitizeCsvCell>{answer.value}</vh:string.sanitizeCsvCell></vh:string.removeQuote>";
 						</f:else>
 						<f:then>
 							"<vh:string.removeQuote>
-								<f:for each="{answer.value}" as="singleValue">
-									<f:if condition="{singleValue}">
-										{singleValue},
-									</f:if>
-								</f:for>
+                                <vh:string.sanitizeCsvCell>
+                                    <f:for each="{answer.value}" as="singleValue">
+                                        <f:if condition="{singleValue}">
+                                            {singleValue},
+                                        </f:if>
+                                    </f:for>
+                                </vh:string.sanitizeCsvCell>
 							</vh:string.removeQuote>";
 						</f:then>
 					</f:if>
diff --git a/Resources/Private/Templates/Output/ExportXls.html b/Resources/Private/Templates/Output/ExportXls.html
index 281c9c1b9..805282766 100644
--- a/Resources/Private/Templates/Output/ExportXls.html
+++ b/Resources/Private/Templates/Output/ExportXls.html
@@ -32,12 +32,12 @@
 										<f:then>
 											<f:for each="{answer.value}" as="singleValue">
 												<f:if condition="{singleValue}">
-													{singleValue},
+													<vh:string.sanitizeCsvCell>{singleValue}</vh:string.sanitizeCsvCell>,
 												</f:if>
 											</f:for>
 										</f:then>
 										<f:else>
-											{answer.value}
+											<vh:string.sanitizeCsvCell>{answer.value}</vh:string.sanitizeCsvCell>
 										</f:else>
 									</f:if>
 								</f:if>