Ability to exclude column by name or data type from `escape_formulas`
Opened this issue · 0 comments
jsonbecker commented
If this is a feature request, why do we need it?
escape_formulas
indiscriminately adds'
to all fields with the@escape_formula_start
values of["=", "-", "+", "@"]
which is great and follows the OWASP guidance, except...- Negative numbers are real and this causes huge problems with round-tripping negative numbers.
- There is no risk posed by data that has a
-
in front that is stored in Elixir as any numeric type-- the risk is data destruction in cases where non-numeric data starts with a-
.
Open questions
- Can we skip based on type before coercing to string or is it better to ask for columns to skip?