CsvHelper
CsvHelper copied to clipboard
Update the default value for InjectionCharacters and InjectionEscapeCharacter
Is your feature request related to a problem? Please describe. Csv injection attack, we need update the default value of InjectionCharacters and InjectionEscapeCharacter in JoshClose\CsvHelper\src\CsvHelper\Configuration\CsvConfiguration.cs
Describe the solution you'd like public virtual char[] InjectionCharacters { get; set; } = new[] { '=', '@', '+', '-','\t','\r' }; public virtual char InjectionEscapeCharacter { get; set; } = ''';
Additional context The following two characters can also be used a injection character Tab (0x09) Carriage return (0x0D)
I made proposed changes, but not sure about that commit - https://github.com/KonH/CsvHelper/commit/4e76b5d8ebc4e0a696644d8c8b811a6fd86a05d4 @chucklu Could you please review it?
Fixed in next release.