51d7c30247
This patch addresses CSV formula injection vulnerabilities by ensuring all Text::CSV instances use formula protection. Changes made: * Add formula => 'empty' to all Text::CSV constructors in: - Koha::Patrons::Import - Koha::BackgroundJob::ImportKBARTFile - Koha::ERM::EUsage::CounterFile The 'empty' formula mode causes potentially dangerous formulas (starting with =, +, -, @) to be treated as empty strings rather than executed, preventing CSV injection attacks while maintaining data integrity. Security impact: * Prevents execution of malicious formulas in CSV imports * Protects against data exfiltration via CSV formula injection * Maintains backward compatibility for legitimate CSV data To test: 1. Apply the previous patch (author test) 2. Run: $ ktd --shell k$ prove xt/author/Text_CSV_Various.t => FAIL: Should show 3 files without formula protection 3. Apply this patch 4. Repeat 2 => SUCCESS: All tests should now pass 5. Try importing CSV with formula content (=cmd|"/c calc",test,data) => SUCCESS: Formula content is rejected/emptied, not executed 6. Import normal CSV data => SUCCESS: Normal data imports correctly 7. Sign off :-D Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> |
||
|---|---|---|
| .. | ||
| Agreement | ||
| EHoldings | ||
| EUsage | ||
| Providers | ||
| Agreement.pm | ||
| Agreements.pm | ||
| Document.pm | ||
| Documents.pm | ||
| License.pm | ||
| Licenses.pm | ||
| UserRole.pm | ||
| UserRoles.pm | ||