SEPURI-SAI-KRISHNA opened a new issue, #45406:
URL: https://github.com/apache/superset/issues/45406
### Bug description
The chart XLSX formula guard looks at the literal first character of a cell,
so
any leading whitespace slips past it. A value like `" =1+1"` or `"\t=cmd"` is
written to the sheet unquoted and is evaluated as a formula when the
workbook is
opened. The CSV export and the streaming XLSX export of the same value both
quote it.
The comment directly above the shared constant says both XLSX writers "guard
against the same formula-injection vectors," which is not true today.
```
input csv xlsx (chart)
'=1+1' quoted quoted
' =1+1' quoted unquoted <- diverges
'\t=1+1' quoted unquoted <- diverges
'\n=1+1' quoted unquoted <- diverges
' @SUM(A1)' quoted unquoted <- diverges
```
### Reproduction
1. Explore any chart whose result has a text cell beginning with a space
then a
formula, for example `" =1+1"`.
2. Export to `.xlsx`.
3. Open the file. The cell evaluates as a formula instead of showing the
literal
text. The same value exported to CSV is quoted.
### Where it happens
`_quote_formula` in `superset/utils/excel.py`:
```python
FORMULA_PREFIXES = {"=", "+", "-", "@"}
def _quote_formula(value):
return (
f"'{value}"
if isinstance(value, str) and len(value) and value[0] in
FORMULA_PREFIXES
else value
)
```
`value[0]` is the literal first character. The two siblings strip first.
`superset/utils/excel_streaming.py`:
```python
stripped = text.lstrip()
return f"'{text}" if stripped and stripped[0] in FORMULA_PREFIXES else text
```
`superset/utils/csv.py` does the same and additionally treats a leading tab
or
carriage return as dangerous on its own.
### Expected behaviour
The chart XLSX writer quotes a formula regardless of leading whitespace, the
same as the streaming XLSX writer and the CSV writer. The shared-constant
comment becomes true.
### Scope
The five inputs both siblings quote and the chart XLSX path does not are
`" =1+1"`, `"\t=1+1"`, `"\r=1+1"`, `"\n=1+1"`, and `" @SUM(A1)"`. The
CSV-only
extras (`|`, `%`, doubled-quote, negative-number handling) are deliberate
design
differences, not part of this report.
### Superset version
master / latest-dev
### Python version
3.11
### Node version
Not applicable
### Browser
Not applicable
### Additional context
Verified against `master` at `a5d29a9d27`. `df_to_excel` then `pd.read_excel`
round-trip: `" =1+1"` reads back as `" =1+1"` (live formula) on master and as
`"' =1+1"` (neutralised) with the one-line strip applied.
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [x] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
