Package io.jenkins.plugins.batchcontrol.ui

Class CsvWriter

java.lang.Object
io.jenkins.plugins.batchcontrol.ui.CsvWriter
@Restricted(org.kohsuke.accmod.restrictions.NoExternalUse.class) public final class CsvWriter extends Object
Minimal CSV emitter for the audit export endpoints (SPEC item 12).

Two independent transformations are applied to every cell, in this order, and they must not be confused with each other:

  1. Formula-injection sanitisation (D-18, S-22). A cell whose first non-whitespace character is =, +, - or @ is prefixed with a single quote, so no spreadsheet application evaluates it. The prefix is the only defence here.
  2. RFC 4180 quoting. A cell containing a comma, a double quote or a line break is wrapped in double quotes with inner quotes doubled. This is a delimiter concern and is not a formula defence: a spreadsheet strips the quotes before looking at the value, so a quoted-but-unprefixed \r=1+1 is still evaluated. Sanitisation therefore runs first, which also puts the prefix inside the quotes where it belongs.

Permission checks are the caller's job.

  • Method Summary

    Modifier and Type
    Method
    Description
    static CsvWriter
    open(org.kohsuke.stapler.StaplerResponse2 rsp, String filename)
    Sets the CSV content type and attachment disposition on the response, writes the UTF-8 byte order mark and returns a writer for the header row and the data rows.
    void
    row(Object... cells)
    Writes one row; each cell is sanitized and quoted as needed.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Method Details

    • open

      public static CsvWriter open(org.kohsuke.stapler.StaplerResponse2 rsp, String filename) throws IOException
      Sets the CSV content type and attachment disposition on the response, writes the UTF-8 byte order mark and returns a writer for the header row and the data rows.

      #43 (owner decision 2026-10-10, D-85): every export starts with the byte order mark, once, so a spreadsheet application reads non-ASCII values (job names, reasons, comments) as UTF-8 instead of the system code page. A strict CSV parser sees it before the first header name (LIMITATIONS).

      Parameters:
      filename - download name; must be a constant, caller-controlled name (never user input)
      Throws:
      IOException

    • row

      public void row(Object... cells)
      Writes one row; each cell is sanitized and quoted as needed. Nulls become empty cells.