[BUG] HTML in "export services" CSV

[mevenG]

What happened?

When exporting the list of services to CSV (and Excel) in bunkerweb 1.6.13, it outputs html tags and classes in the table.

How to reproduce?

Click "Export" then "CSV" or "Excel" in the Services view

Configuration file(s) (yaml or .env)

Relevant log output

BunkerWeb version

1.6.13

What integration are you using?

Linux

Linux distribution (if applicable)

Debian 12

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[TheophileDiot]

Hi @mevenG, thanks for the report.

Confirmed, and it's not just Services. Our export buttons are patched to escape spreadsheet
formula injection, and that patch replaced the very functions that strip HTML out of the cells, so
the markup went into your file. It arrived with a security fix, which is how it went unnoticed.

Affected: every CSV, Excel and "Copy visible" export generated in your browser, so Services,
Jobs, Plugins, Instances, Configs, Cache and Templates. Not affected: the CSV and Excel exports
on Reports and Bans, which are built server-side.

Fixed for the next release, with both protections applied instead of one replacing the other. Until
then those two pages export cleanly, and a find-and-replace on <[^>]*> clears the tags elsewhere.