ROU-12261: adding protection against CSV injection attacks

[rugoncalves]

This PR is for adding protection against CSV injection attacks when exporting data from the Wijmo DataGrid by escaping dangerous cell values. The main change is the introduction of a method to sanitize cell values that start with characters commonly used in spreadsheet formulas, and hooking this logic into the grid's CSV export process.

What was happening

• The component was susceptible to CSV injection attacks, by not escaping dangerous cell values, leaving the end user unprotected.

What was done

• Added a feature named CellValueSanitization
• This new feature has a public method escapeCsvInjection* to sanitize cell values that could trigger CSV injection by prefixing dangerous values with a single quote and handling edge cases with quotes and line breaks.
• Registered a handler in the build method to apply escapeCsvInjection to each cell value during CSV export using Wijmo's gettingCellClipString event**.
• Added a _dangerousStarts array listing characters that can trigger CSV injection (=, +, -, @).

*The method was made public to allow unit-tests to be added in the future.
**Added in the Wijmo 2025 v2 release. This handler is invoked when wijmo is obtaining the cell values to export.

Test Steps

1. Go to the test page
2. Paste the following values on the first column:
   • =1+2
   • =HYPERLINK("https://evil.com","Click here")
   • +HYPERLINK("https://evil.com","Click here")
   • -1+1
   • "=IMAGE("https://evil.com/1x1.png")
   • @SUM(A1:A10)
3. Export to CSV
4. Validate that the values are escaped (see screenshot below)

Screenshots

Checklist

• tested locally
• documented the code
• clean all warnings and errors of eslint
• requires changes in OutSystems (if so, provide a module with changes)
• requires new sample page in OutSystems (if so, provide a module with changes)

[Copilot]

Pull request overview

This PR adds CSV injection attack protection to the Wijmo DataGrid export functionality by implementing cell value sanitization during CSV export operations. The protection prevents malicious formulas from being executed when exported CSV files are opened in spreadsheet applications like Excel, LibreOffice, or Google Sheets.

Changes:

• Added a CSV injection escape method that sanitizes dangerous cell values by prefixing them with a single quote
• Integrated the sanitization logic with Wijmo's gettingCellClipString event to automatically protect all CSV export operations
• Fixed a typo in variable naming from _curPage to _currPage for consistency with codebase conventions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud