TransactionHistory: prevent CSV formula injection in writeCSV

writeCSV wrote the transaction note and subaddress label into the CSV
stripping only the quote character. A cell beginning with =, +, - or @
can be interpreted as a formula by spreadsheet software on open, which
CSV quoting does not prevent.

The transaction note can be attacker-controlled: a payment request's
tx_description is stored as the note when the payment is sent, so a
crafted note can run a spreadsheet formula when the user later exports
and opens their history, potentially enabling data exfiltration or
command execution.

Prefix affected fields with a single quote so they are treated as text;
fields beginning with whitespace or a control character are prefixed too.

Co-authored-by: selsta <selsta@sent.at>

0 files changed, 0 insertions, 0 deletions