Isn't escaping an option? If I open excel and I want to write a formula verbatim, without it being executed, surely there must be a way to do this?

If I understand you're replacing "-" by "!-" ?

This would break a lot of code IMHO

Isn't escaping an option? If I open excel and I want to write a formula verbatim, without it being executed, surely there must be a way to do this?

It seems when editing spreadsheets in Excel directly the general "rule-of-thumb" to prevent a cell from attempting to be executed as a formula is to prepend the cell with an apostrophe. I can update my PR to replace the ! with an ' - apparently Excel will hide the single apostrophe, however I can't confirm that since I don't have access to Excel at the moment.

@timwentzell sorry, I failed to notice that you were already doing some kind of escaping.

@VincentLanglet he's only doing that when the dash is at the start of the line.

Instead of adding that option to each and every future writer that produces files that can be opened with Excel, how about we do this (which you can already do in your project, and allows you not to monitor every change, BTW):

class SafeCellWriterDecorator implements TypedWriterInterface
{
    /** @var TypedWriterInterface */
    private $wrapped;

    public function __construct(TypedWriterInterface $wrapped)
    {
        // here we might want to check if it makes sense to do this with `instanceof CsvWriter`, etc.  
        $this->wrapped = $wrapped;
    }

    public function getDefaultMimeType(): string
    {
        return $this->wrapped->getDefaultMimeType();
    }

    public function getFormat(): string
    {
        return $this->wrapped->getFormat();
    }

    public function open()
    {
        $this->wrapped->open();
    }

    public function close()
    {
        return $this->wrapped->close();
    }

    public function write(array $data)
    {
        // Here, you do your preg_replace()
        return $this->wrapped->write($data);
    }
}

Then we use the configuration nodes you introduce to decide whether we use service decoration or not. It will make it easier for you to write tests, by the way.

By the way, are the headers considered safe?

By the way, are the headers considered safe?

Well the headers are normally dependent on the Entity fields and translation labels - so IMO they would be safe.

Then it's slightly more complex than what I proposed: you would have to take into account showHeaders when implementing SafeCellWriterDecorator::write

What is needed to merge this @greg0ire ?

@VincentLanglet IMO src/Writer/CsvWriter.php should not be touched, and this should be implemented with service decoration instead, as show in the snippet above, only it should also take into account showHeaders to decide whether to act on the first row or not.

@timwentzell Are you still interested in this PR ?

Could you please rebase your PR and fix merge conflicts?

This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.