diff options
| author |   Frédéric Buclin <LpSolit@gmail.com> | 2016-04-25 23:39:02 +0200 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2016-04-25 23:39:02 +0200 |
| commit | 8b0d558c0a41a25eb4b8047fb20d760cb2dc22dd (patch) | |
| tree | 8e6c14a6e2365ecea05a4bd174a6bafd33bb1994 | |
| parent | Bug 542239 - Accept pronouns everywhere in query.cgi (diff) | |
| download | bugzilla-8b0d558c0a41a25eb4b8047fb20d760cb2dc22dd.tar.gz bugzilla-8b0d558c0a41a25eb4b8047fb20d760cb2dc22dd.tar.bz2 bugzilla-8b0d558c0a41a25eb4b8047fb20d760cb2dc22dd.zip | |
Bug 1259881 - CSV export vulnerable to formulae injection (again)
r=sgreen a=dkl
| -rw-r--r-- | Bugzilla/Template.pm | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm index 8104f6f1f..41b9265c6 100644 --- a/Bugzilla/Template.pm +++ b/Bugzilla/Template.pm @@ -865,12 +865,13 @@ sub create { }, # In CSV, quotes are doubled, and any value containing a quote or a - # comma is enclosed in quotes. If a field starts with an equals - # sign, it is proceed by a space. + # comma is enclosed in quotes. + # If a field starts with either "=", "+", "-" or "@", it is preceded + # by a space to prevent stupid formula execution from Excel & co. csv => sub { my ($var) = @_; - $var = ' ' . $var if substr($var, 0, 1) eq '='; + $var = ' ' . $var if $var =~ /^[+=@-]/; # backslash is not special to CSV, but it can be used to confuse some browsers... # so we do not allow it to happen. We only do this for logged-in users. $var =~ s/\\/\x{FF3C}/g if Bugzilla->user->id; |