fix: add excel macro filter for csv output (#1634)

Author: terriko

cve_bin_tool/output_engine/__init__.py

@@ -57,7 +57,14 @@ def save_intermediate(
 
 def output_csv(all_cve_data: Dict[ProductInfo, CVEData], outfile):
     """Output a CSV of CVEs"""
+
     formatted_output = format_output(all_cve_data)
+
+    # Trim any leading -, =, + or @ to avoid excel macros
+    for cve_entry in formatted_output:
+        for key, value in cve_entry.items():
+            cve_entry[key] = value.strip("-=+@")
+
     writer = csv.DictWriter(
         outfile,
         fieldnames=[

test/test_output_engine.py

@@ -844,3 +844,43 @@ def test_output_file_incorrect_filename(self):
 
         # assert
         self.assertEqual(contains_sb, True)
+
+    def test_csv_macros(self):
+        """tests that output engine will not output leading -, =, + or @
+        characters, used in spreadsheet macros"""
+
+        bad_input = {
+            ProductInfo("=vendor0", "+product0", "@1.0"): CVEData(
+                cves=[
+                    CVE(
+                        "-CVE-1234-1234",
+                        "@-=+MEDIUM",
+                        score=4.2,
+                        cvss_version=2,
+                        cvss_vector="C:H",
+                    ),
+                ],
+                paths={"@@@@bad"},
+            ),
+        }
+        expected_output = [
+            {
+                "vendor": "vendor0",
+                "product": "product0",
+                "version": "1.0",
+                "cve_number": "CVE-1234-1234",
+                "severity": "MEDIUM",
+                "score": "4.2",
+                "cvss_version": "2",
+                "cvss_vector": "C:H",
+                "paths": "bad",
+                "remarks": "NewFound",
+                "comments": "",
+            },
+        ]
+
+        output_csv(bad_input, self.mock_file)
+        self.mock_file.seek(0)  # reset file position
+        reader = csv.DictReader(self.mock_file)
+        actual_output = [dict(x) for x in reader]
+        self.assertEqual(actual_output, expected_output)