2f7941a17c
User-controlled values (work item titles, labels, etc.) were written raw into openpyxl worksheet cells, so values beginning with = were stored as live formula cells in exported XLSX files. Apply the same formula-trigger sanitization already used for CSV exports to XLSX cell values and header rows in both export formatters, and sanitize CSV header rows in the porters formatter for parity.
26 lines
971 B
Python
26 lines
971 B
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Utility functions for safe spreadsheet exports (CSV and XLSX)
|
|
# Characters that trigger formula evaluation in spreadsheet applications
|
|
_CSV_FORMULA_TRIGGERS = frozenset(("=", "+", "-", "@", "\t", "\r", "\n"))
|
|
|
|
|
|
def sanitize_csv_value(value):
|
|
"""Sanitize a value for CSV/XLSX export to prevent formula injection.
|
|
|
|
Prefixes string values starting with formula-triggering characters
|
|
with a single quote so spreadsheet applications treat them as text
|
|
instead of evaluating them as formulas.
|
|
|
|
See: https://owasp.org/www-community/attacks/CSV_Injection
|
|
"""
|
|
if isinstance(value, str) and value and value[0] in _CSV_FORMULA_TRIGGERS:
|
|
return "'" + value
|
|
return value
|
|
|
|
|
|
def sanitize_csv_row(row):
|
|
"""Sanitize all values in a CSV/XLSX row."""
|
|
return [sanitize_csv_value(v) for v in row]
|