fix(utils): preserve CSV fields and data URI contents

packages/utils/package.json

@@ -20,7 +20,8 @@
     "check:format": "oxfmt --check .",
     "fix:lint": "oxlint --fix .",
     "fix:format": "oxfmt .",
-    "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist"
+    "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",
+    "test": "vitest run"
   },
   "dependencies": {
     "@makeplane/propel": "catalog:",
@@ -53,6 +54,7 @@
     "@types/react": "catalog:",
     "@types/sanitize-html": "catalog:",
     "tsdown": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }

packages/utils/src/file.test.ts

@@ -0,0 +1,67 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { csvDownload } from "./file";
+
+vi.mock("@plane/constants", () => ({ API_BASE_URL: "" }));
+
+afterEach(() => vi.unstubAllGlobals());
+
+async function download(data: string[][] | Record<string, string>) {
+  const link = { href: "", download: "", click: vi.fn() };
+  const appendChild = vi.fn();
+  const removeChild = vi.fn();
+  vi.stubGlobal("document", {
+    createElement: vi.fn(() => link),
+    body: { appendChild, removeChild },
+  });
+  csvDownload(data, "export");
+  expect(link.download).toBe("export.csv");
+  expect(link.click).toHaveBeenCalledOnce();
+  expect(appendChild).toHaveBeenCalledWith(link);
+  expect(removeChild).toHaveBeenCalledWith(link);
+  return (await fetch(link.href)).text();
+}
+
+describe("csvDownload", () => {
+  it("keeps ordinary object headers and values", async () => {
+    expect(await download({ Title: "Build", "Secret key": "fake-token" })).toBe("Title,Secret key\nBuild,fake-token");
+  });
+  it("preserves a hash and subsequent secret-key columns", async () => {
+    expect(await download({ Title: "Build #42", "Secret key": "fake-token" })).toBe(
+      "Title,Secret key\nBuild #42,fake-token"
+    );
+  });
+  it("quotes commas so user labels do not shift columns", async () => {
+    expect(await download({ Title: "Build, deploy", "Secret key": "fake-token" })).toBe(
+      'Title,Secret key\n"Build, deploy",fake-token'
+    );
+  });
+  it("doubles quotes in quoted cells", async () => {
+    expect(await download([['A "quoted" label', "value"]])).toBe('"A ""quoted"" label",value');
+  });
+  it.each(["\n", "\r", "\r\n"])("quotes embedded %j line endings", async (separator) => {
+    expect(await download([[`first${separator}second`, "value"]])).toBe(`"first${separator}second",value`);
+  });
+  it("preserves Unicode and URI-special characters", async () => {
+    expect(await download([["日本語 # % & ? + =", "last"]])).toBe("日本語 # % & ? + =,last");
+  });
+  it("escapes object headers as well as values", async () => {
+    expect(await download({ "a,b": 'c"d' })).toBe('"a,b"\n"c""d"');
+  });
+  it("preserves empty cells and input data", async () => {
+    const rows = [
+      ["", "last"],
+      ["first", ""],
+    ];
+    expect(await download(rows)).toBe(",last\nfirst,");
+    expect(rows).toEqual([
+      ["", "last"],
+      ["first", ""],
+    ]);
+  });
+});

packages/utils/src/file.ts

@@ -83,8 +83,10 @@ export const getBase64Image = async (url: string): Promise<string> => {
 export const csvDownload = (data: Array<Array<string>> | { [key: string]: string }, name: string) => {
   const rows = Array.isArray(data) ? [...data] : [Object.keys(data), Object.values(data)];
 
-  const csvContent = "data:text/csv;charset=utf-8," + rows.map((e) => e.join(",")).join("\n");
-  const encodedUri = encodeURI(csvContent);
+  const csvContent = rows
+    .map((row) => row.map((cell) => (/[",\r\n]/.test(cell) ? `"${cell.replace(/"/g, '""')}"` : cell)).join(","))
+    .join("\n");
+  const encodedUri = `data:text/csv;charset=utf-8,${encodeURIComponent(csvContent)}`;
 
   const link = document.createElement("a");
   link.href = encodedUri;

packages/utils/vitest.config.ts

@@ -0,0 +1,20 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import path from "node:path";
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["src/**/*.test.ts"],
+    environment: "node",
+  },
+  resolve: {
+    alias: {
+      "@plane/constants": path.resolve(import.meta.dirname, "../constants/src/index.ts"),
+    },
+  },
+});