This patch fixes xt/author/Text_CSV_Various.t by using a regex that can consider logical defined-or statements (|| and //, etc) when checking which formula has been used.
TO TEST:
a) run prove -vv xt/author/Text_CSV_Various.t
*) notice the test fails
== APPLY PATCH ==
b) repeat step a)
*) notice the test now passes
c) inspect diff for xt/author/Text_CSV_Various.t
*) notice we are now using a wildcard (.*) between => and the first ' to skip variable declarations
d) inspect diff for Koha/CSV.pm
*) notice we are now hard-coding 'empty' as a defined-or in case someone decides not to define a format at the class level
(which was not being done before anyway and is now defaulted to undefined)
== SIGN OFF ==
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
- Koha/BackgroundJob/ImportKBARTFile.pm
- Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This commit is generated using:
% perl misc/devel/tidy.pl
*within* ktd, to get the same version of perltidy than what will be used
by our CI (currently v20230309).
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This modules is really not needed.
The wide character test does not make much sense. Just use
encoding as you should.
Test plan:
Run xt/author/Text_CSV_Various.t.
Check about page, perl modules.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
While it might be an idea to just delete it,
this patch attempts to catch everything and make it
clear that Text::CSV::Unicode (binary) is the parser
that should be used.
Signed-off-by: Lee Jamison <ldjamison@marywood.edu>
Running 'prove xt/author/Text_CSV_Various.t' passes
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Jake Deery
Tomás Cohen Arazi
Jonathan Druart
Koha Development Team
Marcel de Rooy
Mark Tompsett
Galen Charlton