lib/phlex/csv.rb in phlex-2.0.0.beta2 vs lib/phlex/csv.rb in phlex-2.0.0.rc1
- old
+ new
@@ -7,17 +7,16 @@
def initialize(collection)
@collection = collection
@_headers = []
@_current_row = []
@_current_column_index = 0
- @_view_context = nil
@_first = true
end
attr_reader :collection
- def call(buffer = +"", view_context: nil)
+ def call(buffer = +"", context: nil)
unless escape_csv_injection? == true || escape_csv_injection? == false
raise <<~MESSAGE
You need to define escape_csv_injection? in #{self.class.name}, returning either `true` or `false`.
CSV injection is a security vulnerability where malicious spreadsheet formulae are used to execute code or exfiltrate data when a CSV is opened in a spreadsheet program such as Microsoft Excel or Google Sheets.
@@ -38,12 +37,10 @@
Unfortunately, there is no one-size-fits-all solution to CSV injection. You need to decide based on your specific use case.
MESSAGE
end
- @_view_context = view_context
-
each_item do |record|
yielder(record) do |*args, **kwargs|
view_template(*args, **kwargs)
if @_first && render_headers?
@@ -71,16 +68,16 @@
private
def column(header = nil, value)
if @_first
- @_headers << escape(header)
+ @_headers << __escape__(header)
elsif header != @_headers[@_current_column_index]
raise "Inconsistent header."
end
- @_current_row << escape(value)
+ @_current_row << __escape__(value)
@_current_column_index += 1
end
def each_item(&)
collection.each(&)
@@ -103,14 +100,10 @@
# Override and set to `false` to disable CSV injection escapes or `true` to enable.
def escape_csv_injection?
nil
end
- def helpers
- @_view_context
- end
-
- def escape(value)
+ def __escape__(value)
value = trim_whitespace? ? value.to_s.strip : value.to_s
first_char = value[0]
last_char = value[-1]
if escape_csv_injection? && FORMULA_PREFIXES.include?(first_char)