Félix Malfait
cebcf4f1f5
**Small Security Issue:** CSV exports were vulnerable to formula injection attacks when users entered values starting with =, +, -, or @. (only happens if a logged-in user injects corrupted data) Solution: - Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous values with invisible Unicode character - This is the best way to preserve original data while preventing Excel from executing formulas - Added import cleanup to restore original values when re-importing Changes: - New sanitizeValueForCSVExport() function for security - Updated all CSV export paths to use both security + formatting functions - Added comprehensive tests covering attack vectors and international characters - Also added cursor rules for better code consistency --------- Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
22 lines
730 B
TypeScript
22 lines
730 B
TypeScript
import { cleanZWJFromImportedValue } from '@/spreadsheet-import/utils/cleanZWJFromImportedValue';
|
|
import { utils, type WorkBook } from 'xlsx-ugnis';
|
|
|
|
export const mapWorkbook = (workbook: WorkBook, sheetName?: string) => {
|
|
const worksheet = workbook.Sheets[sheetName || workbook.SheetNames[0]];
|
|
const data = utils.sheet_to_json(worksheet, {
|
|
header: 1,
|
|
blankrows: false,
|
|
raw: false,
|
|
});
|
|
|
|
// Clean ZWJ characters from imported CSV data to restore original values
|
|
// This reverses the ZWJ protection applied during export
|
|
const cleanedData = (data as string[][]).map((row) =>
|
|
row.map((cell) =>
|
|
typeof cell === 'string' ? cleanZWJFromImportedValue(cell) : cell,
|
|
),
|
|
);
|
|
|
|
return cleanedData;
|
|
};
|