Thanks for the report.

I confirm that when csv_escape_string() receives non-string data, the lack of type cast will lead to always (and sometimes incorrectly) qualifying the string as risky, resulting in tab character to be prepended.

PR https://github.com/mantisbt/mantisbt/pull/2198

@vicsuarez Please test the proposed patch let let me know your feedback.

Note that even after the fix, negative values will still be prefixed by a tab, and Excel will therefore treated them as string instead of number. This cannot be avoided while $g_csv_injection_protection = ON.

Be careful, csv_api.php is broken after patch (lines 122 to 126).

Applying the patch (as primarily intended) is working, fixing the problem from this issue.

This is the original function (I THINK):

function csv_escape_string( $p_string ) {
    $p_string = (string)$p_string;
    if( config_get( 'csv_injection_protection' )
        && $p_string && strpos( '=-+@', $p_string[0] ) !== false){
            # Prefixing with a tab rather than single quote, as Excel does not show
            # the tab visually in the cell.
            $p_string = "\t" . $p_string;
            $t_must_escape = true;
    } else {
        $t_must_escape = false;
        $t_escaped = str_split( '"' . csv_get_separator() . csv_get_newline() );
        while( ( $t_char = current( $t_escaped ) ) !== false && !$t_must_escape ) {
            $t_must_escape = strpos( $p_string, $t_char ) !== false;
            next( $t_escaped );
        }
    }

    if( $t_must_escape ) {
        $p_string = '"' . str_replace( '"', '""', $p_string ) . '"';
    }

    return $p_string;
}

Thanks for the feedback. To make it better next time:

BAD: csv_api.php is broken
GOOD: Parse error: syntax error, unexpected token "&&" in core/csv_api.php on line 125

Anyway, sorry about posting a PR with a syntax error, that was sloppy - I messed up when splitting a commit, and should have re-tested the code before pushing the branch. GitHub actions should have caught this, but for some reason the CI pipeline did not run.

I just pushed a fix to the PR's branch, hopefully it will be OK this time.

Thank you very much, and excuse me for the incorrect expression.