SEPURI-SAI-KRISHNA commented on code in PR #45407:
URL: https://github.com/apache/superset/pull/45407#discussion_r4367643022
##########
superset/utils/excel_streaming.py:
##########
@@ -58,9 +58,12 @@ def _quote_if_formula(text: str) -> str:
Prefix formula-like text with an apostrophe so spreadsheet apps treat it as
literal text (defense against formula injection).
- Leading whitespace is ignored when detecting a formula, because spreadsheet
- apps still evaluate a cell whose formula prefix is preceded by spaces or
- tabs (e.g. ``" =cmd"`` or ``"\\t=cmd"``).
+ Leading whitespace is stripped before the prefix is read, so ``" =cmd"`` is
+ quoted like ``"=cmd"``. Every string goes out through ``write_string``, so
Review Comment:
You are right, and the sentence was wrong rather than imprecise. Measured
with
the quote removed, `write_row` stores `=1+1` as `<f>1+1</f>`. `write_string`
is
used only for the truncation notice and the informational sheet, not for
headers
or data rows.
Reworded to say `write_row` types each cell from its value, so the quote is
what
keeps a formula out of the workbook. The whitespace half is kept separate:
the
prefix is read at the first character only, so `" =cmd"` is a plain string
cell
either way, and quoting it is for cross-path consistency and for how a
downstream reader parses the text.
I wrote that same sentence into my reply on the `excel.py` thread as well, so
that comment is wrong where it says this writer never builds a formula cell.
The rest of it stands, including the cell-type table.
`excel.py` had the inverse gap: accurate, but it never said a bare `=`
becomes a
formula cell there either, so a reader could still take the whole guard as
cosmetic. Measured through `df_to_excel`, without the guard `=1+1` leaves the
string table and the sheet gains a formula cell. Added that sentence there
too.
The claim appears once more in `excel_streaming_tests.py:129`, from #41133
rather than this branch. Correcting it in three places and leaving a fourth
in
the same subsystem's tests seemed worse than touching one extra file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
