Félix Malfait
cebcf4f1f5
**Small Security Issue:** CSV exports were vulnerable to formula injection attacks when users entered values starting with =, +, -, or @. (only happens if a logged-in user injects corrupted data) Solution: - Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous values with invisible Unicode character - This is the best way to preserve original data while preventing Excel from executing formulas - Added import cleanup to restore original values when re-importing Changes: - New sanitizeValueForCSVExport() function for security - Updated all CSV export paths to use both security + formatting functions - Added comprehensive tests covering attack vectors and international characters - Also added cursor rules for better code consistency --------- Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
44 lines
1.5 KiB
TypeScript
44 lines
1.5 KiB
TypeScript
import { SettingsPath } from '@/types/SettingsPath';
|
|
import styled from '@emotion/styled';
|
|
import { getSettingsPath } from '~/utils/navigation/getSettingsPath';
|
|
import {
|
|
AnimatedPlaceholder,
|
|
AnimatedPlaceholderEmptyContainer,
|
|
AnimatedPlaceholderEmptySubTitle,
|
|
AnimatedPlaceholderEmptyTextContainer,
|
|
AnimatedPlaceholderEmptyTitle,
|
|
EMPTY_PLACEHOLDER_TRANSITION_PROPS,
|
|
} from 'twenty-ui/layout';
|
|
import { Button } from 'twenty-ui/input';
|
|
import { IconPlus } from 'twenty-ui/display';
|
|
|
|
const StyledEmptyFunctionsContainer = styled.div`
|
|
height: 60vh;
|
|
`;
|
|
|
|
export const SettingsServerlessFunctionsTableEmpty = () => {
|
|
return (
|
|
<StyledEmptyFunctionsContainer>
|
|
<AnimatedPlaceholderEmptyContainer
|
|
// eslint-disable-next-line react/jsx-props-no-spreading
|
|
{...EMPTY_PLACEHOLDER_TRANSITION_PROPS}
|
|
>
|
|
<AnimatedPlaceholder type="emptyFunctions" />
|
|
<AnimatedPlaceholderEmptyTextContainer>
|
|
<AnimatedPlaceholderEmptyTitle>
|
|
Add your first Function
|
|
</AnimatedPlaceholderEmptyTitle>
|
|
<AnimatedPlaceholderEmptySubTitle>
|
|
Add your first Function to get started
|
|
</AnimatedPlaceholderEmptySubTitle>
|
|
</AnimatedPlaceholderEmptyTextContainer>
|
|
<Button
|
|
Icon={IconPlus}
|
|
title="New function"
|
|
to={getSettingsPath(SettingsPath.NewServerlessFunction)}
|
|
/>
|
|
</AnimatedPlaceholderEmptyContainer>
|
|
</StyledEmptyFunctionsContainer>
|
|
);
|
|
};
|