Félix Malfait
cebcf4f1f5
**Small Security Issue:** CSV exports were vulnerable to formula injection attacks when users entered values starting with =, +, -, or @. (only happens if a logged-in user injects corrupted data) Solution: - Added ZWJ (Zero-Width Joiner) protection that prefixes dangerous values with invisible Unicode character - This is the best way to preserve original data while preventing Excel from executing formulas - Added import cleanup to restore original values when re-importing Changes: - New sanitizeValueForCSVExport() function for security - Updated all CSV export paths to use both security + formatting functions - Added comprehensive tests covering attack vectors and international characters - Also added cursor rules for better code consistency --------- Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
46 lines
1.7 KiB
TypeScript
46 lines
1.7 KiB
TypeScript
import { SettingsPageContainer } from '@/settings/components/SettingsPageContainer';
|
|
import { SettingsRolesQueryEffect } from '@/settings/roles/components/SettingsRolesQueryEffect';
|
|
import { SettingsRolePermissionsObjectLevelObjectPicker } from '@/settings/roles/role-permissions/object-level-permissions/components/SettingsRolePermissionsObjectLevelObjectPicker';
|
|
import { settingsDraftRoleFamilyState } from '@/settings/roles/states/settingsDraftRoleFamilyState';
|
|
import { SettingsPath } from '@/types/SettingsPath';
|
|
import { SubMenuTopBarContainer } from '@/ui/layout/page/components/SubMenuTopBarContainer';
|
|
import { t } from '@lingui/core/macro';
|
|
import { Navigate, useParams } from 'react-router-dom';
|
|
import { useRecoilValue } from 'recoil';
|
|
import { getSettingsPath } from '~/utils/navigation/getSettingsPath';
|
|
|
|
export const SettingsRoleAddObjectLevel = () => {
|
|
const { roleId } = useParams();
|
|
const settingsDraftRole = useRecoilValue(
|
|
settingsDraftRoleFamilyState(roleId ?? ''),
|
|
);
|
|
|
|
if (!roleId) {
|
|
return <Navigate to={getSettingsPath(SettingsPath.Roles)} />;
|
|
}
|
|
|
|
return (
|
|
<>
|
|
<SettingsRolesQueryEffect />
|
|
<SubMenuTopBarContainer
|
|
title={t`1. Select an object`}
|
|
links={[
|
|
{ children: t`Roles`, href: '/settings/roles' },
|
|
{
|
|
children: settingsDraftRole.label ?? '',
|
|
href: `/settings/roles/${roleId}`,
|
|
},
|
|
{
|
|
children: t`Add object permission`,
|
|
href: `/settings/roles/${roleId}/add-object-permission`,
|
|
},
|
|
]}
|
|
>
|
|
<SettingsPageContainer>
|
|
<SettingsRolePermissionsObjectLevelObjectPicker roleId={roleId} />
|
|
</SettingsPageContainer>
|
|
</SubMenuTopBarContainer>
|
|
</>
|
|
);
|
|
};
|