houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent csv export injections (#14347)

Browse Source 
**Small Security Issue:** CSV exports were vulnerable to formula
injection attacks when users entered values starting with =, +, -, or @.
(only happens if a logged-in user injects corrupted data)

Solution:
- Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous
values with invisible Unicode character
- This is the best way to preserve original data while preventing Excel
from executing formulas
- Added import cleanup to restore original values when re-importing
 
Changes:
- New sanitizeValueForCSVExport() function for security
- Updated all CSV export paths to use both security + formatting
functions
- Added comprehensive tests covering attack vectors and international
characters
- Also added cursor rules for better code consistency

---------

Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
This commit is contained in:
Félix Malfait
2025-09-08 17:57:46 +02:00
committed by GitHub
parent 374b5dce66
commit cebcf4f1f5
293 changed files with 1847 additions and 1399 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/api/rest/core/query-builder/core-query-builder.factory.ts
+1 -3
View File
@@ -1,8 +1,6 @@
import { BadRequestException, Injectable } from '@nestjs/common';
import { type Request } from 'express';
import { SettingsPath } from 'twenty-shared/types';
import { getSettingsPath } from 'twenty-shared/utils';
import { CreateManyQueryFactory } from 'src/engine/api/rest/core/query-builder/factories/create-many-query.factory';
import { CreateVariablesFactory } from 'src/engine/api/rest/core/query-builder/factories/create-variables.factory';
@@ -72,7 +70,7 @@ export class CoreQueryBuilderFactory {
`No object was found for the workspace associated with this API key. You may generate a new one here ${this.domainManagerService
.buildWorkspaceURL({
workspace,
pathname: getSettingsPath(SettingsPath.ApiWebhooks),
pathname: '/settings/apis',
})
.toString()}`,
);
packages/twenty-server/src/engine/core-modules/approved-access-domain/services/approved-access-domain.service.ts
+1 -3
View File
@@ -6,8 +6,6 @@ import crypto from 'crypto';
import { t } from '@lingui/core/macro';
import { render } from '@react-email/render';
import { SendApprovedAccessDomainValidation } from 'twenty-emails';
import { SettingsPath } from 'twenty-shared/types';
import { getSettingsPath } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
import { ApprovedAccessDomain as ApprovedAccessDomainEntity } from 'src/engine/core-modules/approved-access-domain/approved-access-domain.entity';
@@ -61,7 +59,7 @@ export class ApprovedAccessDomainService {
const link = this.domainManagerService.buildWorkspaceURL({
workspace,
pathname: getSettingsPath(SettingsPath.Domains),
pathname: `settings/security`,
searchParams: {
wtdId: approvedAccessDomain.id,
validationToken: this.generateUniqueHash(approvedAccessDomain),
packages/twenty-server/src/engine/core-modules/approved-access-domain/services/approved-access-domain.spec.ts
+1 -3
View File
@@ -1,8 +1,6 @@
import { Test, type TestingModule } from '@nestjs/testing';
import { getRepositoryToken } from '@nestjs/typeorm';
import { SettingsPath } from 'twenty-shared/types';
import { getSettingsPath } from 'twenty-shared/utils';
import { type DeleteResult, type Repository } from 'typeorm';
import { ApprovedAccessDomain } from 'src/engine/core-modules/approved-access-domain/approved-access-domain.entity';
@@ -284,7 +282,7 @@ describe('ApprovedAccessDomainService', () => {
expect(domainManagerService.buildWorkspaceURL).toHaveBeenCalledWith({
workspace: workspace,
pathname: getSettingsPath(SettingsPath.Domains),
pathname: 'settings/security',
searchParams: { validationToken: expect.any(String) },
});
packages/twenty-server/src/engine/core-modules/auth/controllers/google-apis-auth.controller.ts
+2 -5
View File
@@ -9,8 +9,6 @@ import {
import { InjectRepository } from '@nestjs/typeorm';
import { Response } from 'express';
import { SettingsPath } from 'twenty-shared/types';
import { getSettingsPath } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
import {
@@ -117,8 +115,7 @@ export class GoogleAPIsAuthController {
this.domainManagerService
.buildWorkspaceURL({
workspace,
pathname:
redirectLocation || getSettingsPath(SettingsPath.Accounts),
pathname: redirectLocation || '/settings/accounts',
})
.toString(),
);
@@ -130,7 +127,7 @@ export class GoogleAPIsAuthController {
subdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
customDomain: null,
},
pathname: getSettingsPath(SettingsPath.Accounts),
pathname: '/settings/accounts',
}),
);
}
packages/twenty-server/src/engine/core-modules/auth/controllers/microsoft-apis-auth.controller.ts
+2 -5
View File
@@ -9,8 +9,6 @@ import {
import { InjectRepository } from '@nestjs/typeorm';
import { Response } from 'express';
import { AppPath, SettingsPath } from 'twenty-shared/types';
import { getSettingsPath } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
import {
@@ -124,8 +122,7 @@ export class MicrosoftAPIsAuthController {
this.domainManagerService
.buildWorkspaceURL({
workspace,
pathname:
redirectLocation || getSettingsPath(SettingsPath.Accounts),
pathname: redirectLocation || '/settings/accounts',
})
.toString(),
);
@@ -137,7 +134,7 @@ export class MicrosoftAPIsAuthController {
subdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
customDomain: null,
},
pathname: AppPath.Verify,
pathname: '/verify',
}),
);
}
packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts
+1 -2
View File
@@ -13,7 +13,6 @@ import { InjectRepository } from '@nestjs/typeorm';
import { generateServiceProviderMetadata } from '@node-saml/node-saml';
import { Response } from 'express';
import { AppPath } from 'twenty-shared/types';
import { Repository } from 'typeorm';
import {
@@ -163,7 +162,7 @@ export class SSOAuthController {
this.domainManagerService.getSubdomainAndCustomDomainFromWorkspaceFallbackOnDefaultSubdomain(
workspaceIdentityProvider?.workspace,
),
pathname: AppPath.Verify,
pathname: '/verify',
}),
);
}
packages/twenty-server/src/engine/core-modules/auth/services/auth.service.ts
+3 -4
View File
@@ -9,7 +9,6 @@ import { render } from '@react-email/render';
import { addMilliseconds } from 'date-fns';
import ms from 'ms';
import { PasswordUpdateNotifyEmail } from 'twenty-emails';
import { AppPath } from 'twenty-shared/types';
import { isDefined } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
@@ -528,7 +527,7 @@ export class AuthService {
}) {
const url = this.domainManagerService.buildWorkspaceURL({
workspace,
pathname: AppPath.Verify,
pathname: '/verify',
searchParams: {
loginToken,
...(billingCheckoutSessionState ? { billingCheckoutSessionState } : {}),
@@ -740,7 +739,7 @@ export class AuthService {
));
const url = this.domainManagerService.buildBaseUrl({
pathname: AppPath.SignInUp,
pathname: '/welcome',
searchParams: {
tokenPair: JSON.stringify({
accessOrWorkspaceAgnosticToken:
@@ -828,7 +827,7 @@ export class AuthService {
this.domainManagerService.getSubdomainAndCustomDomainFromWorkspaceFallbackOnDefaultSubdomain(
currentWorkspace,
),
pathname: AppPath.Verify,
pathname: '/verify',
});
}
}
packages/twenty-server/src/engine/core-modules/auth/services/reset-password.service.ts
+1 -5
View File
@@ -10,8 +10,6 @@ import { addMilliseconds, differenceInMilliseconds } from 'date-fns';
import ms from 'ms';
import { PasswordResetLinkEmail } from 'twenty-emails';
import { type APP_LOCALES } from 'twenty-shared/translations';
import { AppPath } from 'twenty-shared/types';
import { getAppPath } from 'twenty-shared/utils';
import { IsNull, MoreThan, Repository } from 'typeorm';
import {
@@ -141,9 +139,7 @@ export class ResetPasswordService {
const link = this.domainManagerService.buildWorkspaceURL({
workspace,
pathname: getAppPath(AppPath.ResetPassword, {
passwordResetToken: resetToken.passwordResetToken,
}),
pathname: `/reset-password/${resetToken.passwordResetToken}`,
});
const emailData = {
packages/twenty-server/src/engine/core-modules/email-verification/services/email-verification.service.ts
+1 -2
View File
@@ -8,7 +8,6 @@ import { addMilliseconds, differenceInMilliseconds } from 'date-fns';
import ms from 'ms';
import { SendEmailVerificationLinkEmail } from 'twenty-emails';
import { type APP_LOCALES } from 'twenty-shared/translations';
import { AppPath } from 'twenty-shared/types';
import { isDefined } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
@@ -56,7 +55,7 @@ export class EmailVerificationService {
await this.emailVerificationTokenService.generateToken(userId, email);
const linkPathnameAndSearchParams = {
pathname: AppPath.VerifyEmail,
pathname: 'verify-email',
searchParams: {
emailVerificationToken,
email,
packages/twenty-server/src/engine/core-modules/guard-redirect/services/guard-redirect.service.ts
+1 -2
View File
@@ -1,7 +1,6 @@
import { type ExecutionContext, Injectable } from '@nestjs/common';
import { type Request } from 'express';
import { AppPath } from 'twenty-shared/types';
import {
AuthException,
@@ -29,7 +28,7 @@ export class GuardRedirectService {
customDomain: string | null;
isCustomDomainEnabled?: boolean;
},
pathname = AppPath.Verify,
pathname = '/verify',
) {
if ('contextType' in context && context.contextType === 'graphql') {
throw error;
packages/twenty-server/src/engine/core-modules/workspace-invitation/services/workspace-invitation.service.ts
+1 -5
View File
@@ -9,8 +9,6 @@ import { render } from '@react-email/render';
import { addMilliseconds } from 'date-fns';
import ms from 'ms';
import { SendInviteLinkEmail } from 'twenty-emails';
import { AppPath } from 'twenty-shared/types';
import { getAppPath } from 'twenty-shared/utils';
import { IsNull, Repository } from 'typeorm';
import {
@@ -280,9 +278,7 @@ export class WorkspaceInvitationService {
if (invitation.status === 'fulfilled') {
const link = this.domainManagerService.buildWorkspaceURL({
workspace,
pathname: getAppPath(AppPath.Invite, {
workspaceInviteHash: workspace?.inviteHash,
}),
pathname: `invite/${workspace?.inviteHash}`,
searchParams: invitation.value.isPersonalInvitation
? {
inviteToken: invitation.value.appToken.value,
packages/twenty-server/src/engine/metadata-modules/agent/agent-execution.service.ts
+2 -8
View File
@@ -12,11 +12,8 @@ import {
ToolSet,
type UserContent,
} from 'ai';
import { AppPath } from 'twenty-shared/types';
import { getAppPath } from 'twenty-shared/utils';
import { In, Repository } from 'typeorm';
import { AIBillingService } from 'src/engine/core-modules/ai/services/ai-billing.service';
import { AiModelRegistryService } from 'src/engine/core-modules/ai/services/ai-model-registry.service';
import { DomainManagerService } from 'src/engine/core-modules/domain-manager/services/domain-manager.service';
import { FileEntity } from 'src/engine/core-modules/file/entities/file.entity';
@@ -34,6 +31,7 @@ import { type RecordIdsByObjectMetadataNameSingularType } from 'src/engine/metad
import { WorkspacePermissionsCacheService } from 'src/engine/metadata-modules/workspace-permissions-cache/workspace-permissions-cache.service';
import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
import { streamToBuffer } from 'src/utils/stream-to-buffer';
import { AIBillingService } from 'src/engine/core-modules/ai/services/ai-billing.service';
import { AgentToolGeneratorService } from './agent-tool-generator.service';
import { AgentEntity } from './agent.entity';
@@ -206,11 +204,7 @@ export class AgentExecutionService {
...record,
resourceUrl: this.domainManagerService.buildWorkspaceURL({
workspace,
pathname: getAppPath(AppPath.RecordShowPage, {
objectNameSingular:
recordsWithObjectMetadataNameSingular.objectMetadataNameSingular,
objectRecordId: record.id,
}),
pathname: `object/${recordsWithObjectMetadataNameSingular.objectMetadataNameSingular}/${record.id}`,
}),
};
});