gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/t
History
Kyle M Hall c9ffc538de Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e588f810a521065bf46dc037edeac5c83d537714)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
 		2024-11-05 15:43:13 +01:00
..
Acquisition Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Budgets Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Circulation Bug 28931: Use EXPORT_OK from Koha::DateUtils 2021-10-07 11:01:05 +02:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Koha Bug 37018: Unit tests 2024-07-25 09:58:11 +02:00
Number
…
SIP Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Search Bug 34969: Remove unneeded module from buildQuery.t 2023-10-04 09:15:42 -04:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Template Bug 33030: Add unit tests 2023-07-14 16:52:06 -03:00
Test
…
cypress Bug 36774: Add cypress tests 2024-05-24 17:17:49 +02:00
data Bug 31393: Koha::Config: handle the special case for 'content' attribute 2023-10-30 09:02:17 -03:00
db_dependent Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 15:43:13 +01:00
edi_testfiles Bug 35398: Unit test 2024-03-11 10:37:00 +01:00
etc
…
lib Bug 36503: Move and update unit test 2024-07-19 10:58:16 +02:00
mock_templates/intranet-tmpl/prog Bug 33237: (QA follow-up) Clarify tests and Mock 2024-06-27 10:01:00 +02:00
00-check-atomic-updates.t Bug 31479: Option to skip t/00-check-atomic-updates.t when building custom packages 2023-05-10 15:26:20 -03:00
00-deprecated.t
…
00-load.t
…
00-merge-conflict-markers.t
…
00-testcritic.t Bug 34911: Test files from HEAD instead of 'master' 2023-10-04 09:15:35 -04:00
00-valid-xml.t
…
Auth.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AuthoritiesMarc_MARC21.t Bug 31023: Unit tests 2022-09-07 13:52:35 -07:00
AuthoritiesMarc_UNIMARC.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes_EAN13.t
…
Barcodes_annual.t
…
Barcodes_hbyymmincr.t
…
Barcodes_incremental.t
…
Biblio.t Bug 29697: Use flag embed_items 2022-07-22 15:24:11 -03:00
Biblio2.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Budgets.t
…
Charset.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Circulation_barcodedecode.t Bug 30409: (QA follow-up) Avoid uninitialized variable warnings 2022-06-14 08:26:58 -03:00
ClassSortRoutine.t
…
ClassSortRoutine_Dewey.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSortRoutine_Generic.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSortRoutine_LCC.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSource.t
…
Context.t Bug 29033: Add C4::Context->multivalue_preference 2023-10-10 10:53:59 -03:00
Contract.t
…
CookieManager.t Bug 31250: (QA follow-up) The future will be easier 2022-09-12 15:34:11 -03:00
Creators.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
DateUtils.t Bug 36432: Remove circular dependency from Koha::Object 2024-05-23 11:19:11 +02:00
EdiInvoice.t Bug 18267: Refactored Edifact Price Calculations 2020-11-16 13:46:48 +01:00
Edifact.t Bug 35398: Add unit test for extraction of library_rotation_plan 2024-03-11 10:37:00 +01:00
Ediorder.t Bug 31134: Mock EdifactLSQ for t/Edifact.t 2022-07-18 10:20:44 -03:00
Ediordrsp.t
…
Form_MessagingPreferences.t
…
HtmlTags.t
…
ImportBatch.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Installer_PerlModules.t Bug 30731: Unit tests 2022-06-01 16:15:25 -03:00
ItemCirculationAlertPreference.t
…
Koha_MetadataRecord.t Bug 33749: Use TrimFields instead of stripWhitespaceChars 2023-11-03 12:08:06 -03:00
Koha_SearchEngine_Elasticsearch_Browse.t
…
Koha_Template_Plugin_Cache.t
…
Koha_Template_Plugin_HtmlId.t Bug 27336: Sanitize correctly HTML id 2021-01-11 10:27:37 +01:00
Koha_Template_Plugin_Koha.t Bug 31401: (QA follow-up) Remove Koha.ArePluginsEnabled, it is no longer needed 2022-09-07 13:55:37 -07:00
Koha_Util_FrameworkPlugin.t
…
Koha_Util_MARC.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Koha_XSLT_HTTPS.t Bug 12758: Introduce Koha::XSLT::HTTPS 2022-11-09 09:52:17 -03:00
Labels.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Labels_split_Regex.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Labels_split_ccn.t Bug 30110: Fix concatenation during assignements 2022-03-24 14:22:10 -10:00
Labels_split_ddcn.t Bug 30110: Fix concatenation during assignements 2022-03-24 14:22:10 -10:00
Labels_split_lccn.t Bug 30110: Fix concatenation during assignements 2022-03-24 14:22:10 -10:00
Languages.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Logger.t Bug 32979: Skip test if running as root 2023-02-20 09:44:16 -03:00
Makefile.t Bug 31528: (QA follow-up) Exclude .stylelintrc.json in Makefile.t 2022-10-03 09:54:34 -03:00
Members_Messaging.t
…
OpenLibrarySearch.t
…
Output.t Bug 30524: Unit tests 2023-08-07 20:59:59 -03:00
Output_JSONStream.t Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
Patroncards.t
…
Patroncards_Batch.t
…
Patroncards_Lib.t
…
Patroncards_Patroncard.t
…
Patroncards_Profile.t
…
Patroncards_Template.t
…
RecordProcessor.t Bug 33749: (QA follow-up) Tidy code for qa script 2023-11-03 12:08:07 -03:00
Ris.t
…
SMS.t Bug 36307: SMS::Send driver errors are not captured and stored 2024-05-23 14:02:52 +02:00
Scheduler.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.t Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences 2024-04-24 07:36:20 +02:00
Search.t Bug 34968: Remove unneeded module from Search.t 2023-10-04 09:32:46 -04:00
Search_PazPar2.t
…
SimpleMARC.t Bug 24480: (follow-up) Adjust tests 2023-11-03 12:04:35 -03:00
SuggestionEngine.t
…
SuggestionEngine_AuthorityFile.t Bug 34970: Remove most modules from SuggestionEngine_AuthorityFile.t 2023-10-04 09:15:41 -04:00
TmplToken.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Token.t Bug 34163: Handle both anonymous userenv when generating CSRF tokens 2023-09-12 09:45:01 -03:00
dummy.t
…
template_filters.t Bug 29350: Don't need to escape the 'delete' TT methods 2021-11-02 15:58:08 +01:00
timezones.t Bug 28306: Allow to query database with minimal memory footprint 2021-08-31 10:27:52 +02:00