Fix: avoid corrupting JSON-like values in CSV sanitization (#12499)

* Fix: avoid corrupting JSON-like values in CSV sanitization

* Refine CSV sanitization for JSON-like values

* add changeset

* Refactor CSV sanitization with JSON normalization and clean prefix check

* format

---------

Co-authored-by: gradio-pr-bot <[email protected]>
Co-authored-by: Freddy Boulton <[email protected]>

Author: 3 people

.changeset/puny-lions-follow.md

@@ -0,0 +1,5 @@
+---
+"gradio": patch
+---
+
+fix:Fix: avoid corrupting JSON-like values in CSV sanitization

gradio/utils.py

@@ -10,10 +10,8 @@
 import importlib
 import importlib.metadata
 import importlib.resources
-import importlib.util
 import inspect
 import json
-import json.decoder
 import os
 import pkgutil
 import posixpath
@@ -918,14 +916,34 @@ def sanitize_value_for_csv(value: str | float) -> str | float:
     Sanitizes a value that is being written to a CSV file to prevent CSV injection attacks.
     Reference: https://owasp.org/www-community/attacks/CSV_Injection
     """
+    # Numbers are always safe in CSV context
     if isinstance(value, (float, int)):
         return value
+
+    # Coerce non-strings (e.g. tuples) to string defensively
+    if not isinstance(value, str):
+        value = str(value)
+
+    # Special handling for JSON-like values
+    if value.startswith(("{", "[")):
+        try:
+            parsed = json.loads(value)
+            # Return normalized, safe JSON
+            return json.dumps(parsed)
+        except (json.JSONDecodeError, ValueError, TypeError):
+            # Not valid JSON → treat as normal string
+            pass
+
+    # Typical CSV injection protection
     unsafe_prefixes = ["=", "+", "-", "@", "\t", "\n"]
     unsafe_sequences = [",=", ",+", ",-", ",@", ",\t", ",\n"]
+
+    # If starts with any unsafe prefix or contains an unsafe sequence
     if any(value.startswith(prefix) for prefix in unsafe_prefixes) or any(
         sequence in value for sequence in unsafe_sequences
     ):
-        value = f"'{value}"
+        return f"'{value}"
+
     return value