Allow escaping of excel formulas

[czpython]

Hello,
Packages that leverage this app like django-tablib allows us to export user submitted data.
This exposes a potential security issue where users can add excel formulas to certain exported fields.

Excel allows us to use ' at the beginning of any cell value to have it treated as text only and thus not execute any formula.

I did some digging and looks like this feature is not supported.
I'm interested in contributing this but I'm not 100% sure exactly where, is this something that should go on the packaged dependencies?

[iurisilvio]

I think it can be done in xlsx formatter. https://github.com/kennethreitz/tablib/blob/master/tablib/formats/_xlsx.py#L123

You can add a safe argument to import_book/import_set and change the import behaviour when safe=True.

Pull requests are welcome. 👍

[matthewhegarty]

I raised this on the openpyxl forum to ask about best practice for escaping formulae when exporting.

The response was to rewrite cell contents to remove the '=' char for function cell types.

What is the opinion here about implementing this in tablib? (we would potentially need this downstream in django-import-export). I would be happy to work on a PR if you think this is suitable.

[claudep]

I'll gladly review a PR for this.

[matthewhegarty]

@claudep Have submitted PR #540 - would be grateful if you could take a look