gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/t/db_dependent
History
Kyle M Hall 96152682bf Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
 		2024-11-05 22:46:12 +00:00
..
Acquisition Bug 11844: Add tests 2023-05-16 12:58:38 +02:00
Auth Bug 36056: Clarify subpermissions AND behavior 2024-03-19 20:40:27 +00:00
AuthoritiesMarc
…
Authority Bug 29522: Unit test 2024-03-19 21:51:58 +00:00
Biblio Bug 34549: Strip non-XML chars during TransformHtmlToMarc 2023-10-09 09:28:05 -10:00
Budgets Bug 27550: Add unit test for CloneBudgetHierarchy 2022-09-22 08:18:43 -03:00
Circulation Bug 36567: (Rmaint follow-up) fix failing test 2024-05-29 13:09:36 +00:00
CourseReserves Bug 32351: Fix CourseItems.t 2022-11-30 15:58:18 -03:00
Creators Bug 37720: (follow-up) Adjust tests 2024-09-30 21:54:07 +00:00
Exporter Bug 25503: Add failing test for _get_biblio_for_export 2023-05-10 15:26:19 -03:00
Holds Bug 36923: Remove warnings from Holds/LocalHoldsPriority.t 2024-05-31 15:35:47 +00:00
Illrequest Bug 21548: ILLLIBS patron category / partner_code seems extraneous 2023-03-31 12:14:51 +02:00
Items Bug 36010: Fix Items/AutomaticItemModificationByAge.t failing since Bug 32029 2024-03-19 19:50:15 +00:00
Koha Bug 37508: (QA follow-up) Move check to Koha::Report, extend 2024-08-13 11:05:35 -03:00
LDAP
…
Labels Bug 24001: (follow-up) Fix t_Profile.t 2022-04-28 20:26:20 -10:00
Letters Bug 31735: Avoid re-fetcing objects from database by passing them directly instead of ids to various subroutines 2023-05-12 12:40:21 -03:00
Members
…
OAI Bug 29697: Replace some missing occurrences 2022-07-25 09:30:30 -03:00
Patron Bug 14251: Allow use of CSS in discharge letter 2023-03-27 11:53:16 +02:00
Record Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-05 22:46:12 +00:00
Reports Bug 37508: (QA follow-up) Use ->check_columns 2024-08-13 11:05:36 -03:00
Reserves Bug 17798: Confirm hold when printing slip from another patron's account 2023-11-09 21:04:59 -10:00
SIP Bug 36605: [23.05.x] Add update_lastseen to handle_patron_status for SIP 2024-05-28 21:03:36 +00:00
Search
…
Serials Bug 23775: Claiming a serial issue doesn't create the next one 2023-07-17 15:55:19 +01:00
Template/Plugin Bug 33607: Add framework display to staff details page 2023-05-16 15:17:43 -03:00
Utils Bug 34913: Adjust C4::Utils::DataTables::VirtualShelves 2024-03-19 19:19:13 +00:00
api/v1 Merge branch '23.05.x' into 23.05.x-security 2024-07-25 04:53:25 +00:00
cronjobs
…
data Bug 29697: Fix t/db_dependent/Search.t 2022-07-25 10:16:48 -03:00
misc/translator
…
selenium Bug 23102: No mock in selenium 2024-05-28 18:00:21 +00:00
www Bug 35922: Fix www/batch.t 2024-03-19 19:26:32 +00:00
00-strict.t Bug 28617: Remove kohalib.pl and rely on PERL5LIB 2021-12-07 12:16:28 -10:00
01-test_dbic.t
…
Accounts.t Bug 34912: Add 14 hours to 1970 date in Account(s).t 2023-10-05 09:54:39 -10:00
Acquisition.t Bug 25655: Store invoice price and currency even if no currency change 2023-03-06 13:57:53 -03:00
Amazon.t
…
ArticleRequests.t
…
AudioAlerts.t Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Auth.t Bug 36575: (Rmaint follow-up) Fix number of tests 2024-06-03 15:10:14 +00:00
AuthUtils.t
…
Auth_with_cas.t
…
Auth_with_ldap.t Bug 36575: Unit tests for checkpw_ldap 2024-06-03 15:10:13 +00:00
Auth_with_shibboleth.t Bug 36575: Unit tests for checkpw_shib 2024-06-03 15:10:13 +00:00
AuthorisedValues.t Bug 35588: Tidy up t/db_dependent/AuthorisedValues.t 2024-01-12 22:05:02 +00:00
AuthoritiesMarc.t
…
AuthoritiesMarc_GetTagsLabels.t Bug 30446: Add a test for GetTagsLabels 2022-04-21 21:01:09 -10:00
BackgroundJob.t
…
Barcodes.t
…
Barcodes_ValueBuilder.t Bug 26328: Add test 2022-03-23 10:50:51 -10:00
Biblio.t Bug 36473: (follow-up) Additionally warn the stringified exception 2024-05-28 19:19:30 +00:00
Biblio_holdsqueue.t Bug 30728: Add unit tests 2022-05-12 22:17:46 -10:00
Breeding.t Bug 33404: Add unit tests 2023-07-17 16:33:30 +01:00
Breeding_Auth.t Bug 33404: Add unit tests 2023-07-17 16:33:30 +01:00
Budgets.t Bug 32351: Fix Budgets.t 2022-11-30 15:58:15 -03:00
Cache.t
…
Calendar.t Bug 33727: (QA follow-up) perl tidy whole file 2023-07-18 12:40:38 +01:00
Charset.t
…
Circulation.t Bug 36567: Get rid of Datetime warning in Circulation.t and dateexpiry.t 2024-05-28 21:29:58 +00:00
Circulation_holdsqueue.t Bug 30728: Add unit tests 2022-05-12 22:17:46 -10:00
Clubs.t Bug 29736: (QA follow-up) No need to delete all clubs 2022-01-13 16:37:33 -10:00
Context.t Bug 32687: Get server version in Context::get_versions 2023-02-24 17:52:28 -03:00
Contract.t
…
CourseReserves.t
…
DecreaseLoanHighHolds.t Bug 29102: Do not count patron's own hold against limits 2022-11-04 19:20:24 -03:00
Filter_MARC_ViewPolicy.t Bug 32648: Clear cache in Filter_MARC_ViewPolicy.t 2023-05-16 11:24:26 +02:00
Fines.t
…
FrameworkPlugin.t Bug 37146: Add tests 2024-07-18 18:33:21 +12:00
Heading.t Bug 33557: Add LinkerConsiderThesaurus system preference 2023-05-10 15:26:26 -03:00
Heading_MARC21.t Bug 33277: Do not search using thesaurus when linking non 6XX fields 2023-05-10 15:26:22 -03:00
Hold.t Bug 14783: (QA follow-up) Rename method and move tests 2022-10-17 15:43:22 -03:00
Holds.t Bug 32894: (QA follow-up) Fix tests 2023-07-12 07:50:41 +01:00
HoldsQueue.t Bug 32565: (follow-up) Tidy 2024-05-28 21:14:39 +00:00
Holidays.t Bug 27249: Replace DateTime->now by dt_from_string 2023-10-24 20:27:34 -10:00
ILSDI_Services.t Bug 34893: (QA follow-up) Tidy code for qa script 2024-01-24 17:33:44 +00:00
Illcomments.t
…
Illrequestattributes.t
…
Illrequests.t Bug 32548: Add tests 2023-05-09 11:46:58 -03:00
ImportBatch.t Bug 32804: (QA follow-up) Typo ahs and fix ImportBatch.t 2023-03-17 09:59:12 -03:00
ImportExportFramework.t Bug 13952: (follow-up) Tests 2022-04-04 16:23:45 +02:00
Installer.t Bug 26326: (follow-up) Add ability to check for existence of any primary key 2021-11-03 15:40:52 +01:00
Items.t Bug 34656: (QA follow-up) perltidy 2023-09-17 22:03:55 -10:00
Koha.t Bug 30870: Don't skip tests if Test::Deep if not installed 2022-06-01 13:40:26 -03:00
Koha_Database.t
…
Koha_Elasticsearch.t
…
Koha_ExternalContent_OverDrive.t
…
Koha_MetadataRecord_Authority.t Bug 30756: Rename to Koha_MetadataRecord_Authority 2022-06-02 13:53:39 -03:00
Koha_Misc_Files.t
…
Languages.t Bug 32775: (QA follow-up) remove useless empty line 2023-05-15 18:23:54 -03:00
Letters.t Bug 36520: Add tests 2024-06-07 13:16:28 +00:00
LibraryGroups.t Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Linker_Default.t Bug 30280: Add Unit tests 2022-10-03 10:00:12 -03:00
Linker_FirstMatch.t
…
Log.t Bug 32057: (QA follow-up) Add a simple test 2023-03-14 08:49:34 -03:00
MarcModificationTemplates.t Bug 24480: (follow-up) Adjust tests 2023-11-09 15:58:08 -10:00
Members.t Bug 35042: Remove set datelastseen to null on table in Members.t 2023-10-24 21:13:39 -10:00
Message.t Bug 33192: (QA follow-up) Fix it-IT sample data and unit tests 2023-04-14 11:35:40 -03:00
MungeMarcPrice.t
…
Overdues.t Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Passwordrecovery.t Bug 31739: Password recovery from staff fails if previous expired reset-entry exists. 2022-10-24 14:12:16 -03:00
PatronLists.t
…
Patroncards.t
…
Patrons.t Bug 36508: Unit tests 2024-05-23 14:08:27 +00:00
Prices.t Bug 34967: Move to db_dependent 2023-10-05 09:34:17 -10:00
Record.t
…
RecordProcessor_EmbedSeeFromHeadings.t
…
Reports.t
…
Reserves.t Bug 35491: Add logging to RevertWaitingStatus 2024-01-04 20:48:14 +00:00
RotatingCollections.t Bug 29144: Remove opac_info from a few tests 2022-09-16 09:55:20 -03:00
Search.t Bug 36924: Remove warning "Value not allowed for auto_incr itemnumber in Item" 2024-05-31 15:15:16 +00:00
Serials.t Bug 24879: (Rmaint follow-up) Fix text suite 2024-03-27 13:52:50 +00:00
Serials_2.t
…
Service.t
…
ShelfBrowser.t
…
Sitemapper.t
…
Stats.t Bug 30928: Add tests 2023-05-10 14:19:21 -03:00
StockRotationItems.t Bug 30518: Unit test 2022-04-19 21:25:50 -10:00
StockRotationRotas.t
…
StockRotationStages.t Bug 29809: Fix StockRotationStages.t 2022-01-31 21:55:40 -10:00
SuggestionEngine_ExplodedTerms.t Bug 31069: Remove ExplodedTerms dependency on templates 2022-07-18 12:37:35 -03:00
Suggestions.t Bug 35215: Add few assumptions in Suggestions.t around emailing 2023-11-09 21:25:31 -10:00
TablesSettings.t
…
Tags.t Bug 31517: Remove unused get_tag function 2022-11-04 19:30:56 -03:00
Templates.t Bug 29695: Remove GetColumnDefs 2022-04-12 11:40:16 +02:00
TestBuilder.t Bug 32350: Add subtest for bad columns 2022-11-30 12:40:33 -03:00
Upload.t Bug 31598: Fix random failure on Jenkins for Upload.t 2022-09-22 08:07:01 -03:00
UsageStats.t
…
Virtualshelves.t Bug 30418: Unit tests 2023-05-15 18:23:58 -03:00
XISBN.t
…
XSLT.t Bug 33733: Move to db_dependent 2023-05-16 12:38:16 +02:00
check_kohastructure.t
…
check_sysprefs.t Revert "Bug 34979: Add unit test for comparing YAMl files with sysprefs.sql" 2024-02-12 16:03:08 +00:00
db_structure.t
…
rollingloans.t
…
sysprefs.t Bug 36793: Unit test 2024-05-30 19:47:23 +00:00
yaml.t
…
zebra_config.pl
…