Prevent csv export injections (#14347)

**Small Security Issue:** CSV exports were vulnerable to formula
injection attacks when users entered values starting with =, +, -, or @.
(only happens if a logged-in user injects corrupted data)

Solution:
- Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous
values with invisible Unicode character
- This is the best way to preserve original data while preventing Excel
from executing formulas
- Added import cleanup to restore original values when re-importing
 
Changes:
- New sanitizeValueForCSVExport() function for security
- Updated all CSV export paths to use both security + formatting
functions
- Added comprehensive tests covering attack vectors and international
characters
- Also added cursor rules for better code consistency

---------

Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>

packages/twenty-server/src/engine/core-modules/approved-access-domain/services/approved-access-domain.service.ts

@@ -6,8 +6,6 @@ import crypto from 'crypto';
 import { t } from '@lingui/core/macro';
 import { render } from '@react-email/render';
 import { SendApprovedAccessDomainValidation } from 'twenty-emails';
-import { SettingsPath } from 'twenty-shared/types';
-import { getSettingsPath } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
 import { ApprovedAccessDomain as ApprovedAccessDomainEntity } from 'src/engine/core-modules/approved-access-domain/approved-access-domain.entity';
@@ -61,7 +59,7 @@ export class ApprovedAccessDomainService {
 
     const link = this.domainManagerService.buildWorkspaceURL({
       workspace,
-      pathname: getSettingsPath(SettingsPath.Domains),
+      pathname: `settings/security`,
       searchParams: {
         wtdId: approvedAccessDomain.id,
         validationToken: this.generateUniqueHash(approvedAccessDomain),

packages/twenty-server/src/engine/core-modules/approved-access-domain/services/approved-access-domain.spec.ts

@@ -1,8 +1,6 @@
 import { Test, type TestingModule } from '@nestjs/testing';
 import { getRepositoryToken } from '@nestjs/typeorm';
 
-import { SettingsPath } from 'twenty-shared/types';
-import { getSettingsPath } from 'twenty-shared/utils';
 import { type DeleteResult, type Repository } from 'typeorm';
 
 import { ApprovedAccessDomain } from 'src/engine/core-modules/approved-access-domain/approved-access-domain.entity';
@@ -284,7 +282,7 @@ describe('ApprovedAccessDomainService', () => {
 
       expect(domainManagerService.buildWorkspaceURL).toHaveBeenCalledWith({
         workspace: workspace,
-        pathname: getSettingsPath(SettingsPath.Domains),
+        pathname: 'settings/security',
         searchParams: { validationToken: expect.any(String) },
       });
 

packages/twenty-server/src/engine/core-modules/auth/controllers/google-apis-auth.controller.ts

@@ -9,8 +9,6 @@ import {
 import { InjectRepository } from '@nestjs/typeorm';
 
 import { Response } from 'express';
-import { SettingsPath } from 'twenty-shared/types';
-import { getSettingsPath } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
 import {
@@ -117,8 +115,7 @@ export class GoogleAPIsAuthController {
         this.domainManagerService
           .buildWorkspaceURL({
             workspace,
-            pathname:
-              redirectLocation || getSettingsPath(SettingsPath.Accounts),
+            pathname: redirectLocation || '/settings/accounts',
           })
           .toString(),
       );
@@ -130,7 +127,7 @@ export class GoogleAPIsAuthController {
             subdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
             customDomain: null,
           },
-          pathname: getSettingsPath(SettingsPath.Accounts),
+          pathname: '/settings/accounts',
         }),
       );
     }

packages/twenty-server/src/engine/core-modules/auth/controllers/microsoft-apis-auth.controller.ts

@@ -9,8 +9,6 @@ import {
 import { InjectRepository } from '@nestjs/typeorm';
 
 import { Response } from 'express';
-import { AppPath, SettingsPath } from 'twenty-shared/types';
-import { getSettingsPath } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
 import {
@@ -124,8 +122,7 @@ export class MicrosoftAPIsAuthController {
         this.domainManagerService
           .buildWorkspaceURL({
             workspace,
-            pathname:
-              redirectLocation || getSettingsPath(SettingsPath.Accounts),
+            pathname: redirectLocation || '/settings/accounts',
           })
           .toString(),
       );
@@ -137,7 +134,7 @@ export class MicrosoftAPIsAuthController {
             subdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
             customDomain: null,
           },
-          pathname: AppPath.Verify,
+          pathname: '/verify',
         }),
       );
     }

packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts

@@ -13,7 +13,6 @@ import { InjectRepository } from '@nestjs/typeorm';
 
 import { generateServiceProviderMetadata } from '@node-saml/node-saml';
 import { Response } from 'express';
-import { AppPath } from 'twenty-shared/types';
 import { Repository } from 'typeorm';
 
 import {
@@ -163,7 +162,7 @@ export class SSOAuthController {
             this.domainManagerService.getSubdomainAndCustomDomainFromWorkspaceFallbackOnDefaultSubdomain(
               workspaceIdentityProvider?.workspace,
             ),
-          pathname: AppPath.Verify,
+          pathname: '/verify',
         }),
       );
     }

packages/twenty-server/src/engine/core-modules/auth/services/auth.service.ts

@@ -9,7 +9,6 @@ import { render } from '@react-email/render';
 import { addMilliseconds } from 'date-fns';
 import ms from 'ms';
 import { PasswordUpdateNotifyEmail } from 'twenty-emails';
-import { AppPath } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
@@ -528,7 +527,7 @@ export class AuthService {
   }) {
     const url = this.domainManagerService.buildWorkspaceURL({
       workspace,
-      pathname: AppPath.Verify,
+      pathname: '/verify',
       searchParams: {
         loginToken,
         ...(billingCheckoutSessionState ? { billingCheckoutSessionState } : {}),
@@ -740,7 +739,7 @@ export class AuthService {
         ));
 
       const url = this.domainManagerService.buildBaseUrl({
-        pathname: AppPath.SignInUp,
+        pathname: '/welcome',
         searchParams: {
           tokenPair: JSON.stringify({
             accessOrWorkspaceAgnosticToken:
@@ -828,7 +827,7 @@ export class AuthService {
           this.domainManagerService.getSubdomainAndCustomDomainFromWorkspaceFallbackOnDefaultSubdomain(
             currentWorkspace,
           ),
-        pathname: AppPath.Verify,
+        pathname: '/verify',
       });
     }
   }

packages/twenty-server/src/engine/core-modules/auth/services/reset-password.service.ts

@@ -10,8 +10,6 @@ import { addMilliseconds, differenceInMilliseconds } from 'date-fns';
 import ms from 'ms';
 import { PasswordResetLinkEmail } from 'twenty-emails';
 import { type APP_LOCALES } from 'twenty-shared/translations';
-import { AppPath } from 'twenty-shared/types';
-import { getAppPath } from 'twenty-shared/utils';
 import { IsNull, MoreThan, Repository } from 'typeorm';
 
 import {
@@ -141,9 +139,7 @@ export class ResetPasswordService {
 
     const link = this.domainManagerService.buildWorkspaceURL({
       workspace,
-      pathname: getAppPath(AppPath.ResetPassword, {
-        passwordResetToken: resetToken.passwordResetToken,
-      }),
+      pathname: `/reset-password/${resetToken.passwordResetToken}`,
     });
 
     const emailData = {

packages/twenty-server/src/engine/core-modules/email-verification/services/email-verification.service.ts

@@ -8,7 +8,6 @@ import { addMilliseconds, differenceInMilliseconds } from 'date-fns';
 import ms from 'ms';
 import { SendEmailVerificationLinkEmail } from 'twenty-emails';
 import { type APP_LOCALES } from 'twenty-shared/translations';
-import { AppPath } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
@@ -56,7 +55,7 @@ export class EmailVerificationService {
       await this.emailVerificationTokenService.generateToken(userId, email);
 
     const linkPathnameAndSearchParams = {
-      pathname: AppPath.VerifyEmail,
+      pathname: 'verify-email',
       searchParams: {
         emailVerificationToken,
         email,

packages/twenty-server/src/engine/core-modules/guard-redirect/services/guard-redirect.service.ts

@@ -1,7 +1,6 @@
 import { type ExecutionContext, Injectable } from '@nestjs/common';
 
 import { type Request } from 'express';
-import { AppPath } from 'twenty-shared/types';
 
 import {
   AuthException,
@@ -29,7 +28,7 @@ export class GuardRedirectService {
       customDomain: string | null;
       isCustomDomainEnabled?: boolean;
     },
-    pathname = AppPath.Verify,
+    pathname = '/verify',
   ) {
     if ('contextType' in context && context.contextType === 'graphql') {
       throw error;

packages/twenty-server/src/engine/core-modules/workspace-invitation/services/workspace-invitation.service.ts

@@ -9,8 +9,6 @@ import { render } from '@react-email/render';
 import { addMilliseconds } from 'date-fns';
 import ms from 'ms';
 import { SendInviteLinkEmail } from 'twenty-emails';
-import { AppPath } from 'twenty-shared/types';
-import { getAppPath } from 'twenty-shared/utils';
 import { IsNull, Repository } from 'typeorm';
 
 import {
@@ -280,9 +278,7 @@ export class WorkspaceInvitationService {
       if (invitation.status === 'fulfilled') {
         const link = this.domainManagerService.buildWorkspaceURL({
           workspace,
-          pathname: getAppPath(AppPath.Invite, {
-            workspaceInviteHash: workspace?.inviteHash,
-          }),
+          pathname: `invite/${workspace?.inviteHash}`,
           searchParams: invitation.value.isPersonalInvitation
             ? {
                 inviteToken: invitation.value.appToken.value,