package server import "testing" // TestCSVSafe checks the CSV/spreadsheet formula-injection guard used by the admin Messages // export: a leading formula trigger is quoted, everything else is left intact. func TestCSVSafe(t *testing.T) { tests := []struct{ in, want string }{ {"", ""}, {"hello", "hello"}, {"=1+1", "'=1+1"}, {"+cmd", "'+cmd"}, {"-2", "'-2"}, {"@SUM(A1)", "'@SUM(A1)"}, {"\tx", "'\tx"}, {"\rx", "'\rx"}, {"good luck", "good luck"}, {"a=b", "a=b"}, // a formula char that is not leading must be left untouched } for _, tc := range tests { if got := csvSafe(tc.in); got != tc.want { t.Errorf("csvSafe(%q) = %q, want %q", tc.in, got, tc.want) } } }