Prevent csv export injections (#14347)

**Small Security Issue:** CSV exports were vulnerable to formula
injection attacks when users entered values starting with =, +, -, or @.
(only happens if a logged-in user injects corrupted data)

Solution:
- Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous
values with invisible Unicode character
- This is the best way to preserve original data while preventing Excel
from executing formulas
- Added import cleanup to restore original values when re-importing
 
Changes:
- New sanitizeValueForCSVExport() function for security
- Updated all CSV export paths to use both security + formatting
functions
- Added comprehensive tests covering attack vectors and international
characters
- Also added cursor rules for better code consistency

---------

Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>

packages/twenty-server/src/engine/core-modules/auth/controllers/google-apis-auth.controller.ts

@@ -9,8 +9,6 @@ import {
 import { InjectRepository } from '@nestjs/typeorm';
 
 import { Response } from 'express';
-import { SettingsPath } from 'twenty-shared/types';
-import { getSettingsPath } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
 import {
@@ -117,8 +115,7 @@ export class GoogleAPIsAuthController {
         this.domainManagerService
           .buildWorkspaceURL({
             workspace,
-            pathname:
-              redirectLocation || getSettingsPath(SettingsPath.Accounts),
+            pathname: redirectLocation || '/settings/accounts',
           })
           .toString(),
       );
@@ -130,7 +127,7 @@ export class GoogleAPIsAuthController {
             subdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
             customDomain: null,
           },
-          pathname: getSettingsPath(SettingsPath.Accounts),
+          pathname: '/settings/accounts',
         }),
       );
     }

packages/twenty-server/src/engine/core-modules/auth/controllers/microsoft-apis-auth.controller.ts

@@ -9,8 +9,6 @@ import {
 import { InjectRepository } from '@nestjs/typeorm';
 
 import { Response } from 'express';
-import { AppPath, SettingsPath } from 'twenty-shared/types';
-import { getSettingsPath } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
 import {
@@ -124,8 +122,7 @@ export class MicrosoftAPIsAuthController {
         this.domainManagerService
           .buildWorkspaceURL({
             workspace,
-            pathname:
-              redirectLocation || getSettingsPath(SettingsPath.Accounts),
+            pathname: redirectLocation || '/settings/accounts',
           })
           .toString(),
       );
@@ -137,7 +134,7 @@ export class MicrosoftAPIsAuthController {
             subdomain: this.twentyConfigService.get('DEFAULT_SUBDOMAIN'),
             customDomain: null,
           },
-          pathname: AppPath.Verify,
+          pathname: '/verify',
         }),
       );
     }

packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts

@@ -13,7 +13,6 @@ import { InjectRepository } from '@nestjs/typeorm';
 
 import { generateServiceProviderMetadata } from '@node-saml/node-saml';
 import { Response } from 'express';
-import { AppPath } from 'twenty-shared/types';
 import { Repository } from 'typeorm';
 
 import {
@@ -163,7 +162,7 @@ export class SSOAuthController {
             this.domainManagerService.getSubdomainAndCustomDomainFromWorkspaceFallbackOnDefaultSubdomain(
               workspaceIdentityProvider?.workspace,
             ),
-          pathname: AppPath.Verify,
+          pathname: '/verify',
         }),
       );
     }

packages/twenty-server/src/engine/core-modules/auth/services/auth.service.ts

@@ -9,7 +9,6 @@ import { render } from '@react-email/render';
 import { addMilliseconds } from 'date-fns';
 import ms from 'ms';
 import { PasswordUpdateNotifyEmail } from 'twenty-emails';
-import { AppPath } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { Repository } from 'typeorm';
 
@@ -528,7 +527,7 @@ export class AuthService {
   }) {
     const url = this.domainManagerService.buildWorkspaceURL({
       workspace,
-      pathname: AppPath.Verify,
+      pathname: '/verify',
       searchParams: {
         loginToken,
         ...(billingCheckoutSessionState ? { billingCheckoutSessionState } : {}),
@@ -740,7 +739,7 @@ export class AuthService {
         ));
 
       const url = this.domainManagerService.buildBaseUrl({
-        pathname: AppPath.SignInUp,
+        pathname: '/welcome',
         searchParams: {
           tokenPair: JSON.stringify({
             accessOrWorkspaceAgnosticToken:
@@ -828,7 +827,7 @@ export class AuthService {
           this.domainManagerService.getSubdomainAndCustomDomainFromWorkspaceFallbackOnDefaultSubdomain(
             currentWorkspace,
           ),
-        pathname: AppPath.Verify,
+        pathname: '/verify',
       });
     }
   }

packages/twenty-server/src/engine/core-modules/auth/services/reset-password.service.ts

@@ -10,8 +10,6 @@ import { addMilliseconds, differenceInMilliseconds } from 'date-fns';
 import ms from 'ms';
 import { PasswordResetLinkEmail } from 'twenty-emails';
 import { type APP_LOCALES } from 'twenty-shared/translations';
-import { AppPath } from 'twenty-shared/types';
-import { getAppPath } from 'twenty-shared/utils';
 import { IsNull, MoreThan, Repository } from 'typeorm';
 
 import {
@@ -141,9 +139,7 @@ export class ResetPasswordService {
 
     const link = this.domainManagerService.buildWorkspaceURL({
       workspace,
-      pathname: getAppPath(AppPath.ResetPassword, {
-        passwordResetToken: resetToken.passwordResetToken,
-      }),
+      pathname: `/reset-password/${resetToken.passwordResetToken}`,
     });
 
     const emailData = {