beatrichartz/csv

Ability to exclude column by name or data type from `escape_formulas`

Opened this issue · 0 comments

If this is a feature request, why do we need it?

  • escape_formulas indiscriminately adds ' to all fields with the @escape_formula_start values of ["=", "-", "+", "@"] which is great and follows the OWASP guidance, except...
  • Negative numbers are real and this causes huge problems with round-tripping negative numbers.
  • There is no risk posed by data that has a - in front that is stored in Elixir as any numeric type-- the risk is data destruction in cases where non-numeric data starts with a -.

Open questions

  • Can we skip based on type before coercing to string or is it better to ask for columns to skip?