gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/t
History
Kyle M Hall 3d03eff4a4 Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads

This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.

Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
   ( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
   where users can define the outputted data

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
 		2024-11-07 23:02:54 +00:00
..
Acquisition Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Budgets Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Circulation Bug 28931: Use EXPORT_OK from Koha::DateUtils 2021-10-07 11:01:05 +02:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Koha Bug 37389: Add tests 2024-08-29 17:42:21 +00:00
Number
…
SIP Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Search Bug 34969: Remove unneeded module from buildQuery.t 2023-10-04 09:15:42 -04:00
Serials Bug 32392: Tests for changes in C4::Serials::GetNextSeq 2024-04-29 15:19:30 +02:00
Template Bug 33030: Add unit tests 2023-07-14 16:52:06 -03:00
Test
…
cypress Bug 37620: Improve cypress test to reduce random failures 2024-09-12 21:53:01 +00:00
data Bug 31393: Koha::Config: handle the special case for 'content' attribute 2023-10-30 09:02:17 -03:00
db_dependent Bug 33339: Prevent Formula Injection (CSV Injection) in CSV files 2024-11-07 23:02:54 +00:00
edi_testfiles Bug 35398: Unit test 2024-03-07 15:02:46 +01:00
etc
…
lib Bug 36916: Do not generate invalid JS or CSS from TestBuilder 2024-05-24 15:36:44 +02:00
mock_templates/intranet-tmpl/prog Bug 37575: Typo 'AutoCreateAuthorites' in about.pl 2024-09-11 16:26:41 +00:00
00-check-atomic-updates.t Bug 31479: Option to skip t/00-check-atomic-updates.t when building custom packages 2023-05-10 15:26:20 -03:00
00-deprecated.t
…
00-load.t
…
00-merge-conflict-markers.t
…
00-testcritic.t Bug 34911: Test files from HEAD instead of 'master' 2023-10-04 09:15:35 -04:00
00-valid-xml.t
…
Auth.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
AuthoritiesMarc_MARC21.t Bug 31023: Unit tests 2022-09-07 13:52:35 -07:00
AuthoritiesMarc_UNIMARC.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes_EAN13.t
…
Barcodes_annual.t
…
Barcodes_hbyymmincr.t
…
Barcodes_incremental.t
…
Biblio.t Bug 29697: Use flag embed_items 2022-07-22 15:24:11 -03:00
Biblio2.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Budgets.t
…
Charset.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Circulation_barcodedecode.t Bug 30409: (QA follow-up) Avoid uninitialized variable warnings 2022-06-14 08:26:58 -03:00
ClassSortRoutine.t
…
ClassSortRoutine_Dewey.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSortRoutine_Generic.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSortRoutine_LCC.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSource.t
…
Context.t Bug 29033: Add C4::Context->multivalue_preference 2023-10-10 10:53:59 -03:00
Contract.t
…
CookieManager.t Bug 31250: (QA follow-up) The future will be easier 2022-09-12 15:34:11 -03:00
Creators.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
DateUtils.t Bug 36432: Remove circular dependency from Koha::Object 2024-04-04 15:24:32 +02:00
EdiInvoice.t
…
Edifact.t Bug 35398: Add unit test for extraction of library_rotation_plan 2024-03-07 15:02:46 +01:00
Ediorder.t Bug 31134: Mock EdifactLSQ for t/Edifact.t 2022-07-18 10:20:44 -03:00
Ediordrsp.t
…
Form_MessagingPreferences.t
…
HtmlTags.t
…
ImportBatch.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Installer_PerlModules.t Bug 30731: Unit tests 2022-06-01 16:15:25 -03:00
ItemCirculationAlertPreference.t
…
Koha_MetadataRecord.t Bug 33749: Use TrimFields instead of stripWhitespaceChars 2023-11-03 12:08:06 -03:00
Koha_SearchEngine_Elasticsearch_Browse.t
…
Koha_Template_Plugin_HtmlId.t
…
Koha_Template_Plugin_Koha.t Bug 31401: (QA follow-up) Remove Koha.ArePluginsEnabled, it is no longer needed 2022-09-07 13:55:37 -07:00
Koha_Util_FrameworkPlugin.t
…
Koha_Util_MARC.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Koha_XSLT_HTTPS.t Bug 12758: Introduce Koha::XSLT::HTTPS 2022-11-09 09:52:17 -03:00
Labels.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Labels_split_Regex.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Labels_split_ccn.t Bug 30110: Fix concatenation during assignements 2022-03-24 14:22:10 -10:00
Labels_split_ddcn.t Bug 30110: Fix concatenation during assignements 2022-03-24 14:22:10 -10:00
Labels_split_lccn.t Bug 30110: Fix concatenation during assignements 2022-03-24 14:22:10 -10:00
Languages.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Logger.t Bug 35907: Add ability to log all custom report runs with or without query 2024-05-10 16:45:45 +02:00
Makefile.t Bug 31528: (QA follow-up) Exclude .stylelintrc.json in Makefile.t 2022-10-03 09:54:34 -03:00
Members_Messaging.t
…
OpenLibrarySearch.t
…
Output.t Bug 30524: Unit tests 2023-08-07 20:59:59 -03:00
Output_JSONStream.t
…
Patroncards.t
…
Patroncards_Batch.t
…
Patroncards_Lib.t
…
Patroncards_Patroncard.t
…
Patroncards_Profile.t
…
Patroncards_Template.t
…
RecordProcessor.t Bug 33749: (QA follow-up) Tidy code for qa script 2023-11-03 12:08:07 -03:00
Ris.t
…
SMS.t Bug 36307: SMS::Send driver errors are not captured and stored 2024-04-05 17:39:46 +02:00
Scheduler.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.t Bug 36328: (QA follow-up) Expand tests and reorder elements to clarify differences 2024-04-22 12:39:20 +02:00
Search.t Bug 34968: Remove unneeded module from Search.t 2023-10-04 09:32:46 -04:00
Search_PazPar2.t
…
SimpleMARC.t Bug 35993: Add SimpleMarc::update_last_transaction_time 2024-04-29 09:35:55 +02:00
SuggestionEngine.t
…
SuggestionEngine_AuthorityFile.t Bug 34970: Remove most modules from SuggestionEngine_AuthorityFile.t 2023-10-04 09:15:41 -04:00
TmplToken.t Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Token.t Bug 34478: (follow-up) Manual fix - Make Koha::Token use session id not userenv id 2024-03-01 11:00:25 +01:00
dummy.t
…
template_filters.t Bug 29350: Don't need to escape the 'delete' TT methods 2021-11-02 15:58:08 +01:00
timezones.t Bug 28306: Allow to query database with minimal memory footprint 2021-08-31 10:27:52 +02:00