Fixed a potential CSV injection vulnerability.

CHANGELOG.md

@@ -28,6 +28,9 @@
 - Fixed a bug where duplicated entries that were created via an “Applying new propagation method” job weren’t getting positioned correctly based on the original entries’ structure. ([#9782](https://github.com/craftcms/cms/issues/9782))
 - Fixed a bug where unpublished drafts could disappear after clicking “Create entry” if the URI could not be made unique. ([#9873](https://github.com/craftcms/cms/issues/9873))
 
+### Security
+- Fixed a potential CSV injection vulnerability.
+
 ## 3.7.13 - 2021-09-14
 
 ### Added

src/web/CsvResponseFormatter.php

@@ -83,10 +83,18 @@ public function format($response)
             fputcsv($fp, $headers, ',');
         }
 
+        $suspectCharacters = ['=', '-', '+', '@'];
+
         foreach ($data as $row) {
             foreach ($row as &$field) {
                 if (is_scalar($field)) {
                     $field = (string)$field;
+
+                    // Guard against CSV injection attacks
+                    // https://github.com/thephpleague/csv/issues/268
+                    if ($field && $field !== '' && in_array($field[0], $suspectCharacters)) {
+                        $field = "\t$field";
+                    }
                 } else {
                     $field = Json::encode($field);
                 }