F3: CSV export does not neutralise spreadsheet formula injection #83

Found in ART Milestone 0 (#53). Code read at main 032b522.

Problem

csv-table-hub-main/src/lib/export.ts:43-46 (escapeCsv) quotes values containing ", , or a newline. It does not neutralise values starting with =, +, -, @, tab or carriage return. The error-report and audit-report CSV exports contain user-supplied cell values, so opening an export in Excel can execute a formula payload such as =HYPERLINK(...).

Fix

Prefix such values with ' (OWASP CSV injection guidance) in escapeCsv. Check whether the XLSX path (json_to_sheet) needs the same treatment. Add vitest cases with formula payloads.

Part of ART M1. BR-35.

Generated by Claude Code