Prevent csv export injections (#14347)

**Small Security Issue:** CSV exports were vulnerable to formula injection attacks when users entered values starting with =, +, -, or @. (only happens if a logged-in user injects corrupted data) Solution: - Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous values with invisible Unicode character - This is the best way to preserve original data while preventing Excel from executing formulas - Added import cleanup to restore original values when re-importing Changes: - New sanitizeValueForCSVExport() function for security - Updated all CSV export paths to use both security + formatting functions - Added comprehensive tests covering attack vectors and international characters - Also added cursor rules for better code consistency --------- Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
2025-09-08 17:57:46 +02:00
parent 374b5dce66
commit cebcf4f1f5
293 changed files with 1847 additions and 1399 deletions
@@ -1,5 +0,0 @@
-export enum AppBasePath {
-  Auth = '/auth',
-  Settings = '/settings',
-  Root = '/',
-}
@@ -1,37 +0,0 @@
-export enum AppPath {
-  // Not logged-in
-  Verify = '/verify',
-  VerifyEmail = '/verify-email',
-  SignInUp = '/welcome',
-  Invite = '/invite/:workspaceInviteHash',
-  ResetPassword = '/reset-password/:passwordResetToken',
-
-  // Onboarding
-  CreateWorkspace = '/create/workspace',
-  CreateProfile = '/create/profile',
-  SyncEmails = '/sync/emails',
-  InviteTeam = '/invite-team',
-  PlanRequired = '/plan-required',
-  PlanRequiredSuccess = '/plan-required/payment-success',
-  BookCallDecision = '/book-call-decision',
-  BookCall = '/book-call',
-
-  // Onboarded
-  Index = '/',
-  TasksPage = '/objects/tasks',
-  OpportunitiesPage = '/objects/opportunities',
-
-  RecordIndexPage = '/objects/:objectNamePlural',
-  RecordShowPage = '/object/:objectNameSingular/:objectRecordId',
-
-  Settings = `settings`,
-  SettingsCatchAll = `/${Settings}/*`,
-  Developers = `developers`,
-  DevelopersCatchAll = `/${Developers}/*`,
-
-  Authorize = '/authorize',
-
-  // 404 page not found
-  NotFoundWildcard = '*',
-  NotFound = '/not-found',
-}
@@ -1,60 +0,0 @@
-export enum SettingsPath {
-  ProfilePage = 'profile',
-  TwoFactorAuthenticationStrategyConfig = 'profile/two-factor-authentication/:twoFactorAuthenticationStrategy',
-  Experience = 'experience',
-  Accounts = 'accounts',
-  NewAccount = 'accounts/new',
-  AccountsCalendars = 'accounts/calendars',
-  AccountsEmails = 'accounts/emails',
-  NewImapSmtpCaldavConnection = 'accounts/new-imap-smtp-caldav-connection',
-  EditImapSmtpCaldavConnection = 'accounts/edit-imap-smtp-caldav-connection/:connectedAccountId',
-  Billing = 'billing',
-  Objects = 'objects',
-  ObjectOverview = 'objects/overview',
-  ObjectDetail = 'objects/:objectNamePlural',
-  ObjectNewFieldSelect = 'objects/:objectNamePlural/new-field/select',
-  ObjectNewFieldConfigure = 'objects/:objectNamePlural/new-field/configure',
-  ObjectFieldEdit = 'objects/:objectNamePlural/:fieldName',
-  NewObject = 'objects/new',
-  ServerlessFunctions = 'functions',
-  NewServerlessFunction = 'functions/new',
-  ServerlessFunctionDetail = 'functions/:serverlessFunctionId',
-  WorkspaceMembersPage = 'members',
-  Workspace = 'general',
-  Domains = 'domains',
-  Domain = 'domains/domain',
-  NewApprovedAccessDomain = 'domains/approved-access-domain/new',
-  Releases = 'releases',
-  AI = 'ai',
-  AINewAgent = 'ai/new-agent',
-  AIAgentDetail = 'ai/agents/:agentId',
-  ApiWebhooks = 'api-webhooks',
-  RestPlayground = 'playground/rest/:schema',
-  GraphQLPlayground = 'playground/graphql/:schema',
-  NewApiKey = 'api-webhooks/apis/new',
-  ApiKeyDetail = 'api-webhooks/apis/:apiKeyId',
-  NewWebhook = 'api-webhooks/webhooks/new',
-  WebhookDetail = 'api-webhooks/webhooks/:webhookId',
-  Integrations = 'integrations',
-  IntegrationMCP = 'integrations/mcp',
-  IntegrationDatabase = 'integrations/:databaseKey',
-  IntegrationDatabaseConnection = 'integrations/:databaseKey/:connectionId',
-  IntegrationEditDatabaseConnection = 'integrations/:databaseKey/:connectionId/edit',
-  IntegrationNewDatabaseConnection = 'integrations/:databaseKey/new',
-  Security = 'security',
-  NewSSOIdentityProvider = 'security/sso/new',
-
-  AdminPanel = 'admin-panel',
-  AdminPanelHealthStatus = 'admin-panel#health-status',
-  AdminPanelIndicatorHealthStatus = 'admin-panel/health-status/:indicatorId',
-  AdminPanelConfigVariableDetails = 'admin-panel/config-variables/:variableName',
-
-  Roles = 'roles',
-  RoleCreate = 'roles/create',
-  RoleDetail = 'roles/:roleId',
-  RoleObjectLevel = 'roles/:roleId/object/:objectMetadataId',
-  RoleAddObjectLevel = 'roles/:roleId/add-object-permission',
-  PageLayout = 'page-layout',
-  PageLayoutNew = 'page-layout/new',
-  PageLayoutEdit = 'page-layout/:id',
-}
@@ -9,8 +9,6 @@

 export type { AllowedAddressSubField } from './AddressFieldsType';
 export { ALLOWED_ADDRESS_SUBFIELDS } from './AddressFieldsType';
-export { AppBasePath } from './AppBasePath';
-export { AppPath } from './AppPath';
 export type { ConfigVariableValue } from './ConfigVariableValue';
 export { ConnectedAccountProvider } from './ConnectedAccountProvider';
 export type { EnumFieldMetadataType } from './EnumFieldMetadataType';
@@ -36,7 +34,6 @@ export type {
 export { DEFAULT_RELATIVE_DATE_VALUE } from './RelativeDateValue';
 export type { RestrictedFieldPermissions } from './RestrictedFieldPermissions';
 export type { RestrictedFieldsPermissions } from './RestrictedFieldsPermissions';
-export { SettingsPath } from './SettingsPath';
 export type { StepFilterGroup, StepFilter } from './StepFilters';
 export { StepLogicalOperator } from './StepFilters';
 export { TwoFactorAuthenticationStrategy } from './TwoFactorAuthenticationStrategy';
@@ -24,8 +24,6 @@ export {
  getLogoUrlFromDomainName,
 } from './image/getLogoUrlFromDomainName';
 export { getUniqueConstraintsFields } from './indexMetadata/getUniqueConstraintsFields';
-export { getAppPath } from './navigation/getAppPath';
-export { getSettingsPath } from './navigation/getSettingsPath';
 export { parseJson } from './parseJson';
 export { removePropertiesFromRecord } from './removePropertiesFromRecord';
 export { removeUndefinedFields } from './removeUndefinedFields';
@@ -1,110 +0,0 @@
-import { AppPath } from '../../../types';
-import { getAppPath } from '../getAppPath';
-
-describe('getAppPath', () => {
-  it('should return path as-is when no params or query params provided', () => {
-    expect(getAppPath(AppPath.Index)).toBe('/');
-    expect(getAppPath(AppPath.TasksPage)).toBe('/objects/tasks');
-    expect(getAppPath(AppPath.SignInUp)).toBe('/welcome');
-  });
-
-  it('should generate path with params using react-router generatePath', () => {
-    expect(
-      getAppPath(AppPath.RecordIndexPage, {
-        objectNamePlural: 'companies',
-      }),
-    ).toBe('/objects/companies');
-
-    expect(
-      getAppPath(AppPath.RecordShowPage, {
-        objectNameSingular: 'company',
-        objectRecordId: '123',
-      }),
-    ).toBe('/object/company/123');
-
-    expect(
-      getAppPath(AppPath.Invite, {
-        workspaceInviteHash: 'abc123',
-      }),
-    ).toBe('/invite/abc123');
-  });
-
-  it('should append query params when provided', () => {
-    expect(
-      getAppPath(AppPath.Index, undefined, {
-        filter: 'active',
-        sort: 'name',
-      }),
-    ).toBe('/?filter=active&sort=name');
-
-    expect(
-      getAppPath(AppPath.TasksPage, undefined, {
-        view: 'kanban',
-      }),
-    ).toBe('/objects/tasks?view=kanban');
-  });
-
-  it('should handle both params and query params together', () => {
-    expect(
-      getAppPath(
-        AppPath.RecordIndexPage,
-        { objectNamePlural: 'companies' },
-        { filter: 'active', view: 'table' },
-      ),
-    ).toBe('/objects/companies?filter=active&view=table');
-
-    expect(
-      getAppPath(
-        AppPath.RecordShowPage,
-        { objectNameSingular: 'company', objectRecordId: '123' },
-        { tab: 'details' },
-      ),
-    ).toBe('/object/company/123?tab=details');
-  });
-
-  it('should filter out null and undefined values from query params', () => {
-    expect(
-      getAppPath(AppPath.Index, undefined, {
-        filter: 'active',
-        sort: null,
-        view: undefined,
-        limit: '10',
-      }),
-    ).toBe('/?filter=active&limit=10');
-  });
-
-  it('should handle empty query params object', () => {
-    expect(getAppPath(AppPath.Index, undefined, {})).toBe('/');
-  });
-
-  it('should handle query params with only null/undefined values', () => {
-    expect(
-      getAppPath(AppPath.Index, undefined, {
-        filter: null,
-        sort: undefined,
-      }),
-    ).toBe('/');
-  });
-
-  it('should handle complex query param values', () => {
-    expect(
-      getAppPath(AppPath.Index, undefined, {
-        filters: JSON.stringify({ status: 'active' }),
-        array: ['value1', 'value2'],
-        number: 42,
-        boolean: true,
-      }),
-    ).toBe(
-      '/?filters=%7B%22status%22%3A%22active%22%7D&array%5B0%5D=value1&array%5B1%5D=value2&number=42&boolean=true',
-    );
-  });
-
-  it('should handle special characters in query params', () => {
-    expect(
-      getAppPath(AppPath.Index, undefined, {
-        search: 'test & query',
-        email: 'user@example.com',
-      }),
-    ).toBe('/?search=test%20%26%20query&email=user%40example.com');
-  });
-});
@@ -1,148 +0,0 @@
-import { SettingsPath } from '../../../types';
-import { getSettingsPath } from '../getSettingsPath';
-
-describe('getSettingsPath', () => {
-  it('should return settings path with correct prefix when no params or query params provided', () => {
-    expect(getSettingsPath(SettingsPath.ProfilePage)).toBe('/settings/profile');
-    expect(getSettingsPath(SettingsPath.Workspace)).toBe('/settings/general');
-    expect(getSettingsPath(SettingsPath.Accounts)).toBe('/settings/accounts');
-  });
-
-  it('should generate path with params using react-router generatePath', () => {
-    expect(
-      getSettingsPath(SettingsPath.ObjectDetail, {
-        objectNamePlural: 'companies',
-      }),
-    ).toBe('/settings/objects/companies');
-
-    expect(
-      getSettingsPath(SettingsPath.ObjectFieldEdit, {
-        objectNamePlural: 'companies',
-        fieldName: 'name',
-      }),
-    ).toBe('/settings/objects/companies/name');
-
-    expect(
-      getSettingsPath(SettingsPath.ServerlessFunctionDetail, {
-        serverlessFunctionId: 'func123',
-      }),
-    ).toBe('/settings/functions/func123');
-
-    expect(
-      getSettingsPath(SettingsPath.EditImapSmtpCaldavConnection, {
-        connectedAccountId: 'account123',
-      }),
-    ).toBe('/settings/accounts/edit-imap-smtp-caldav-connection/account123');
-  });
-
-  it('should append query params when provided', () => {
-    expect(
-      getSettingsPath(SettingsPath.ProfilePage, undefined, {
-        tab: 'personal',
-        edit: 'true',
-      }),
-    ).toBe('/settings/profile?tab=personal&edit=true');
-
-    expect(
-      getSettingsPath(SettingsPath.Objects, undefined, {
-        view: 'list',
-      }),
-    ).toBe('/settings/objects?view=list');
-  });
-
-  it('should append hash when provided', () => {
-    expect(
-      getSettingsPath(
-        SettingsPath.ProfilePage,
-        undefined,
-        undefined,
-        'section1',
-      ),
-    ).toBe('/settings/profile#section1');
-
-    expect(
-      getSettingsPath(SettingsPath.Workspace, undefined, undefined, 'general'),
-    ).toBe('/settings/general#general');
-  });
-
-  it('should handle hash with leading # character', () => {
-    expect(
-      getSettingsPath(
-        SettingsPath.ProfilePage,
-        undefined,
-        undefined,
-        '#section1',
-      ),
-    ).toBe('/settings/profile#section1');
-  });
-
-  it('should handle params, query params, and hash together', () => {
-    expect(
-      getSettingsPath(
-        SettingsPath.ObjectDetail,
-        { objectNamePlural: 'companies' },
-        { tab: 'fields', edit: 'true' },
-        'advanced',
-      ),
-    ).toBe('/settings/objects/companies?tab=fields&edit=true#advanced');
-
-    expect(
-      getSettingsPath(
-        SettingsPath.ServerlessFunctionDetail,
-        { serverlessFunctionId: 'func123' },
-        { mode: 'edit' },
-        'code',
-      ),
-    ).toBe('/settings/functions/func123?mode=edit#code');
-  });
-
-  it('should filter out null and undefined values from query params', () => {
-    expect(
-      getSettingsPath(SettingsPath.ProfilePage, undefined, {
-        tab: 'personal',
-        edit: null,
-        view: undefined,
-        active: 'true',
-      }),
-    ).toBe('/settings/profile?tab=personal&active=true');
-  });
-
-  it('should handle empty query params object', () => {
-    expect(getSettingsPath(SettingsPath.ProfilePage, undefined, {})).toBe(
-      '/settings/profile',
-    );
-  });
-
-  it('should handle query params with only null/undefined values', () => {
-    expect(
-      getSettingsPath(SettingsPath.ProfilePage, undefined, {
-        tab: null,
-        edit: undefined,
-      }),
-    ).toBe('/settings/profile');
-  });
-
-  it('should handle complex query param values', () => {
-    expect(
-      getSettingsPath(SettingsPath.Objects, undefined, {
-        filters: JSON.stringify({ type: 'custom' }),
-        sort: ['name', 'created'],
-        page: 1,
-        enabled: true,
-      }),
-    ).toBe(
-      '/settings/objects?filters=%7B%22type%22%3A%22custom%22%7D&sort%5B0%5D=name&sort%5B1%5D=created&page=1&enabled=true',
-    );
-  });
-
-  it('should handle special characters in query params', () => {
-    expect(
-      getSettingsPath(SettingsPath.ProfilePage, undefined, {
-        search: 'test & query',
-        email: 'user@example.com',
-      }),
-    ).toBe(
-      '/settings/profile?search=test%20%26%20query&email=user%40example.com',
-    );
-  });
-});
@@ -1,30 +0,0 @@
-import qs from 'qs';
-import { generatePath, type PathParam } from 'react-router-dom';
-import { type AppPath } from '../../types';
-import { isDefined } from '../validation';
-
-export const getAppPath = <T extends AppPath>(
-  to: T,
-  params?: { [key in PathParam<T>]: string | null },
-  queryParams?: Record<string, any>,
-) => {
-  let path: string = to;
-
-  if (isDefined(params)) {
-    path = generatePath<T>(to, params);
-  }
-
-  if (isDefined(queryParams)) {
-    const filteredParams = Object.fromEntries(
-      Object.entries(queryParams).filter(([_, value]) => isDefined(value)),
-    );
-
-    const queryString = qs.stringify(filteredParams);
-
-    if (queryString !== '') {
-      path += `?${queryString}`;
-    }
-  }
-
-  return path;
-};
@@ -1,40 +0,0 @@
-import qs from 'qs';
-import { generatePath, type PathParam } from 'react-router-dom';
-import { AppPath, type SettingsPath } from '../../types';
-import { isDefined } from '../validation';
-
-export const getSettingsPath = <T extends SettingsPath>(
-  to: T,
-  params?: {
-    [key in PathParam<`/${AppPath.Settings}/${T}`>]: string | null;
-  },
-  queryParams?: Record<string, any>,
-  hash?: string,
-) => {
-  let path = `/${AppPath.Settings}/${to}`;
-
-  if (isDefined(params)) {
-    path = generatePath<`/${AppPath.Settings}/${T}`>(
-      `/${AppPath.Settings}/${to}`,
-      params,
-    );
-  }
-
-  if (isDefined(queryParams)) {
-    const filteredParams = Object.fromEntries(
-      Object.entries(queryParams).filter(([_, value]) => isDefined(value)),
-    );
-
-    const queryString = qs.stringify(filteredParams);
-
-    if (queryString !== '') {
-      path += `?${queryString}`;
-    }
-  }
-
-  if (isDefined(hash)) {
-    path += `#${hash.replace(/^#/, '')}`;
-  }
-
-  return path;
-};