a0ef38c4c3
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
- Koha/BackgroundJob/ImportKBARTFile.pm
- Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
|
||
|---|---|---|
| .. | ||
| author | ||
| api.t | ||
| check_makefile.t | ||
| find-license-problems.t | ||
| find-misplaced-executables.t | ||
| find-missing-auth_checks.t | ||
| find-missing-csrf.t | ||
| find-missing-filters.t | ||
| find-missing-op-in-forms.t | ||
| js_tidy.t | ||
| single_quotes.t | ||
| tt_valid.t | ||
| verify-debian-docbook.t | ||
| verify-yarnlock.t | ||
| verify_bib1.att.t | ||
| vue_tidy.t | ||
| yaml_valid.pl | ||
| yaml_valid.t | ||