League\Csv\EscapeFormulaInjection

Complexity

Total Complexity

13

Size/Duplication

Total Lines	123
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	0

Test Coverage

Coverage

100%

Importance

Changes

0

8 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	9	2
A	filterSpecialCharacters()	0	4	1
A	getSpecialCharacters()	0	4	1
A	getEscape()	0	4	1
A	__invoke()	0	4	1
A	escapeRecord()	0	4	1
A	escapeField()	0	13	3
A	isStringable()	0	4	3

<?php
/**
* This file is part of the League.csv library
*
* @license http://opensource.org/licenses/MIT
* @link https://github.com/thephpleague/csv/
* @version 9.1.0
* @package League.csv
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
declare(strict_types=1);

namespace League\Csv;

/**
 * A League CSV formatter to tackle CSV Formula Injection
 *
 * @see http://georgemauer.net/2017/10/07/csv-injection.html
 *
 * @package League.csv
 * @since   9.1.0
 * @author  Ignace Nyamagana Butera <nyamsprod@gmail.com>
 */
class EscapeFormulaInjection
{
    /**
     * Special characters that will be escaped
     *
     * @var string[]
     */
    protected $special_chars = [];

    /**
     * Escape character
     *
     * @var string
     */
    protected $escape;

    /**
     * New instance
     *
     * @param string   $escape
     * @param string[] $special_chars additional special characters to escape
     */
    public function __construct(string $escape = "\t", array $special_chars = [])
    {
        $this->escape = $escape;
        if (!empty($special_chars)) {
            $special_chars = $this->filterSpecialCharacters(...$special_chars);
        }
        $special_chars = array_merge(['=', '-', '+', '@'], $special_chars);
        $this->special_chars = array_fill_keys(array_unique($special_chars), 1);
    }

    /**
     * Filter submitted special characters.
     *
     * @param string ...$characters
     *
     * @return string[]
     */
    protected function filterSpecialCharacters(string ...$characters): array
    {
        return $characters;
    }

    /**
     * Returns the list of character the instance will escape.
     *
     * @return string[]
     */
    public function getSpecialCharacters(): array
    {
        return array_keys($this->special_chars);
    }

    /**
     * Returns the escape character.
     *
     * @return string
     */
    public function getEscape(): string
    {
        return $this->escape;
    }

    /**
     * League CSV formatter hook.
     *
     * @see escapeRecord
     *
     * @param array $record
     *
     * @return array
     */
    public function __invoke(array $record): array
    {
        return $this->escapeRecord($record);
    }

    /**
     * Escape a CSV record.
     *
     * @param array $record
     *
     * @return array
     */
    public function escapeRecord(array $record): array
    {
        return array_map([$this, 'escapeField'], $record);
    }

    /**
     * Escape a CSV cell.
     *
     * @param mixed $cell
     *
     * @return mixed
     */
    protected function escapeField($cell)
    {
        if (!$this->isStringable($cell)) {
            return $cell;
        }

        $str_cell = (string) $cell;
        if (isset($str_cell[0], $this->special_chars[$str_cell[0]])) {
            return $this->escape.$str_cell;
        }

        return $cell;
    }

    /**
     * Tell whether the submitted value is stringable.
     *
     * @param mixed $value
     *
     * @return bool
     */
    protected function isStringable($value): bool
    {
        return is_string($value) || (is_object($value) && method_exists($value, '__toString'));
    }
}