Enhanced CSV handling with escape character support and sanitized input

classes/Visualizer/Module.php

@@ -285,11 +285,11 @@ private function _getCSV( $rows, $filename, $enclose ) {
 		// support for MS Excel
 		fprintf( $fp, $bom );
 		foreach ( $rows as $row ) {
-			fputcsv( $fp, $row );
+			fputcsv( $fp, $row, ',', '"', VISUALIZER_CSV_ESCAPE );
 		}
 		rewind( $fp );
 		$csv = '';
-		$array = fgetcsv( $fp );
+		$array = fgetcsv( $fp, 0, ',', '"', VISUALIZER_CSV_ESCAPE );
 		while ( $array !== false ) {
 			if ( strlen( $csv ) > 0 ) {
 				$csv .= PHP_EOL;
@@ -307,7 +307,7 @@ private function _getCSV( $rows, $filename, $enclose ) {
 				$array = $temp_array;
 			}
 			$csv  .= implode( ',', $array );
-			$array = fgetcsv( $fp );
+			$array = fgetcsv( $fp, 0, ',', '"', VISUALIZER_CSV_ESCAPE );
 		}
 		fclose( $fp );
 

classes/Visualizer/Module/Abilities.php

@@ -1209,7 +1209,7 @@ private function buildManualSource( $input ) {
 			return new WP_Error( 'visualizer_tmp_file', __( 'A temporary file could not be created.', 'visualizer' ) );
 		}
 		foreach ( $lines as $line ) {
-			fputcsv( $handle, $line, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE );
+			fputcsv( $handle, $line, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, VISUALIZER_CSV_ESCAPE );
 		}
 		fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
 

classes/Visualizer/Module/Chart.php

@@ -346,10 +346,10 @@ public function getCharts() {
 		if ( ! current_user_can( 'edit_others_posts' ) ) {
 			$query_args['author'] = get_current_user_id();
 		}
-		$filter     = filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING );
+		$filter     = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';
 		if ( empty( $filter ) ) {
 			// 'filter' is from the modal from the add media button.
-			$filter = filter_input( INPUT_GET, 'filter', FILTER_SANITIZE_STRING );
+			$filter = isset( $_GET['filter'] ) ? sanitize_text_field( wp_unslash( $_GET['filter'] ) ) : '';
 		}
 
 		if ( $filter && in_array( $filter, Visualizer_Plugin::getChartTypes(), true ) ) {
@@ -1259,7 +1259,7 @@ private function handleTabularData() {
 				foreach ( $exclude as $j ) {
 					unset( $row[ $j ] );
 				}
-				fputcsv( $handle, $row );
+				fputcsv( $handle, $row, ',', '"', VISUALIZER_CSV_ESCAPE );
 			}
 		}
 		$source = new Visualizer_Source_Csv( $tmpfile );

classes/Visualizer/Source/Csv.php

@@ -61,7 +61,7 @@ public function __construct( $filename = '' ) {
 	 */
 	private function _fetchSeries( &$handle ) {
 		// read column titles
-		$labels = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE );
+		$labels = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, VISUALIZER_CSV_ESCAPE );
 		$types = null;
 
 		if ( false !== strpos( $this->_filename, 'tqx=out:csv' ) ) {
@@ -74,7 +74,7 @@ private function _fetchSeries( &$handle ) {
 
 		if ( is_null( $types ) ) {
 			// read series types
-			$types = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE );
+			$types = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, VISUALIZER_CSV_ESCAPE );
 		}
 
 		if ( ! is_array( $labels ) || ! is_array( $types ) ) {
@@ -155,10 +155,10 @@ public function fetch() {
 		}
 
 		// fetch data
-		$data = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE );
+		$data = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, VISUALIZER_CSV_ESCAPE );
 		while ( $data !== false ) {
 			$this->_data[] = $this->_normalizeData( $data );
-			$data = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE );
+			$data = fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, VISUALIZER_CSV_ESCAPE );
 		}
 
 		// close file handle

index.php

@@ -81,6 +81,9 @@ function visualizer_launch() {
 	if ( ! defined( 'VISUALIZER_CSV_ENCLOSURE' ) ) {
 		define( 'VISUALIZER_CSV_ENCLOSURE', '"' );
 	}
+	if ( ! defined( 'VISUALIZER_CSV_ESCAPE' ) ) {
+		define( 'VISUALIZER_CSV_ESCAPE', '\\' );
+	}
 	if ( ! defined( 'VISUALIZER_DEBUG' ) ) {
 		define( 'VISUALIZER_DEBUG', false );
 	}

tests/php/static-analysis-stubs/symbols.php

@@ -18,6 +18,9 @@
 if ( ! defined( 'VISUALIZER_CSV_ENCLOSURE' ) ) {
     define( 'VISUALIZER_CSV_ENCLOSURE', '"' );
 }
+if ( ! defined( 'VISUALIZER_CSV_ESCAPE' ) ) {
+    define( 'VISUALIZER_CSV_ESCAPE', '\\' );
+}
 if ( ! defined( 'VISUALIZER_DEBUG' ) ) {
     define( 'VISUALIZER_DEBUG', false );
 }

tests/test-ajax.php

@@ -988,6 +988,45 @@ public function test_get_charts_only_lists_editable_scope_for_contributor() {
 		$this->assertNotContains( $other_chart, $chart_ids );
 	}
 
+	/**
+	 * Request params the chart library reads the chart type filter from.
+	 *
+	 * @return array<string, array{0: string}>
+	 */
+	public function chart_type_filter_param_provider(): array {
+		return array(
+			'search box'  => array( 's' ),
+			'media modal' => array( 'filter' ),
+		);
+	}
+
+	/**
+	 * The chart library filters by the requested chart type.
+	 *
+	 * @dataProvider chart_type_filter_param_provider
+	 *
+	 * @param string $param Request param carrying the chart type.
+	 */
+	public function test_get_charts_filters_by_chart_type( string $param ): void {
+		$this->create_chart_for_user( $this->admin_user_id, 'publish' );
+		$pie_chart = $this->create_chart_for_user( $this->admin_user_id, 'publish' );
+		update_post_meta( $pie_chart, Visualizer_Plugin::CF_CHART_TYPE, 'pie' );
+		$_GET = array(
+			'nonce' => wp_create_nonce( Visualizer_Plugin::ACTION_GET_CHARTS ),
+			$param  => 'pie',
+		);
+
+		try {
+			$this->_handleAjax( Visualizer_Plugin::ACTION_GET_CHARTS );
+		} catch ( WPAjaxDieContinueException $e ) {
+			// Expected after the JSON response.
+		}
+
+		$response = json_decode( $this->_last_response, true );
+		$this->assertTrue( $response['success'] );
+		$this->assertSame( array( $pie_chart ), wp_list_pluck( $response['data'], 'id' ) );
+	}
+
 	/**
 	 * A valid nonce does not permit deleting another user's chart.
 	 */

tests/test-csv-escape.php

@@ -0,0 +1,57 @@
+<?php
+/**
+ * CSV escape character handling.
+ *
+ * @package     visualizer
+ * @subpackage  Tests
+ * @license     http://opensource.org/licenses/gpl-2.0.php GNU Public License
+ */
+
+/**
+ * Test the CSV escape character passed to fgetcsv()/fputcsv().
+ */
+class Test_Csv_Escape extends WP_UnitTestCase {
+
+	/**
+	 * Temporary CSV file.
+	 *
+	 * @var string
+	 */
+	private $file = '';
+
+	/**
+	 * Remove the temporary CSV file.
+	 */
+	public function tearDown(): void {
+		if ( $this->file ) {
+			wp_delete_file( $this->file );
+		}
+		parent::tearDown();
+	}
+
+	/**
+	 * CSV import keeps the backslash escape and logs no deprecation.
+	 */
+	public function test_csv_import_uses_backslash_escape(): void {
+		$this->file = wp_tempnam( 'visualizer' );
+		file_put_contents( $this->file, "Label,Value\nstring,number\n\"say \\\"hi\\\"\",1\n" );
+
+		$deprecations = array();
+		set_error_handler(
+			static function ( int $errno, string $errstr ) use ( &$deprecations ): bool {
+				$deprecations[] = $errstr;
+				return true;
+			},
+			E_DEPRECATED
+		);
+		try {
+			$source = new Visualizer_Source_Csv( $this->file );
+			$this->assertTrue( $source->fetch() );
+		} finally {
+			restore_error_handler();
+		}
+
+		$this->assertSame( array(), $deprecations );
+		$this->assertSame( 'say "hi"', $source->getRawData()[0][0] );
+	}
+}