escapeFormula (csv/formula.ts)

Prevents CSV formula injection attacks.

// Source: https://github.com/productdevbook/hucre | License: MIT | Copyright 2026 productdevbook
// Provided via justclaw.it.com; keep this notice with the code.
// Formula-injection escaping, shared by every CSV writer and reader.
//
// It lives in its own module because the escape and its inverse have to
// agree on one list of trigger characters: the reader strips a leading
// apostrophe only where the writer would have added one (#408). Two copies
// of the list would drift, and a drifted list corrupts data in exactly the
// cases the escape exists to protect.

// Characters that trigger formula interpretation in Excel/Sheets/LibreOffice
// Covers: formulas (=), unary operators (+, -), at-sign (@), whitespace injection (\t, \r, \n), null byte (\0)
const FORMULA_PREFIXES = ["=", "+", "

... (truncated -- full source via MCP)