gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41619: (Follow-up) Consider Logical Defined-Or in test 

This patch fixes xt/author/Text_CSV_Various.t by using a regex that can consider logical defined-or statements (|| and //, etc) when checking which formula has been used.

TO TEST:
a)  run prove -vv xt/author/Text_CSV_Various.t
    *)  notice the test fails
== APPLY PATCH ==
b)  repeat step a)
    *)  notice the test now passes
c)  inspect diff for xt/author/Text_CSV_Various.t
    *)  notice we are now using a wildcard (.*) between => and the first ' to skip variable declarations
d)  inspect diff for Koha/CSV.pm
    *)  notice we are now hard-coding 'empty' as a defined-or in case someone decides not to define a format at the class level
        (which was not being done before anyway and is now defaulted to undefined)
== SIGN OFF ==

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Jake Deery 2026-02-19 12:22:30 +00:00 committed by Lucas Gass
parent fb921843ab
commit 7a0113e044
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Koha/CSV.pm
View File

@ -91,7 +91,7 @@ sub new {
my $self = $class->SUPER::new(
{
binary => 1, # Always 1 for UTF-8
formula => 'empty', # Always 'empty' for security
formula => undef, # Hard-coded to empty for security
always_quote => $params->{always_quote} // 0, # Overridable
eol => $params->{eol} // "\n", # Overridable
sep_char => $sep_char, # From Koha config or override
@ -101,7 +101,7 @@ sub new {
$self->{_csv} = Text::CSV_XS->new(
{
binary => $self->binary,
formula => $self->formula,
formula => $self->formula // 'empty',
always_quote => $self->always_quote,
eol => $self->eol,
sep_char => $self->sep_char,

2
xt/author/Text_CSV_Various.t
View File

@ -127,7 +127,7 @@ subtest 'CSV formula injection protection' => sub {
for my $call (@new_calls) {
# Check if this specific call has formula protection
unless ( $call =~ /formula\s*=>\s*['"](?:empty|die|croak|diag)['"]/
unless ( $call =~ /formula\s*=>.*['"](?:empty|die|croak|diag)['"]/
|| $call =~ /formula\s*=>\s*[1-5]/ )
{
$has_unprotected = 1;