Skip to content

bugzilla
bugzilla
Commit b578b2ae authored by Simon Green's avatar Simon Green Committed by David Lawrence
Browse files
Options

Bug 1054702: CSV export vulnerable to formulae injection

r=glob,a=glob
parent a92eee1c
Hide whitespace changes
Inline Side-by-side
Showing with 8 additions and 4 deletions
Bugzilla/Template.pm
View file @ b578b2ae
...@@ -711,10 +711,12 @@ sub create { ...@@ -711,10 +711,12 @@ sub create {
}, },
# In CSV, quotes are doubled, and any value containing a quote or a # In CSV, quotes are doubled, and any value containing a quote or a
# comma is enclosed in quotes. # comma is enclosed in quotes. If a field starts with an equals
# sign, it is proceed by a space.
csv => sub csv => sub
{ {
my ($var) = @_; my ($var) = @_;
$var = ' ' . $var if substr($var, 0, 1) eq '=';
$var =~ s/\"/\"\"/g; $var =~ s/\"/\"\"/g;
if ($var !~ /^-?(\d+\.)?\d*$/) { if ($var !~ /^-?(\d+\.)?\d*$/) {
$var = "\"$var\""; $var = "\"$var\"";
......
template/en/default/reports/report-table.csv.tmpl
View file @ b578b2ae
...@@ -23,11 +23,13 @@ ...@@ -23,11 +23,13 @@
[% END %] [% END %]
[% tbl_field_disp FILTER csv %]: [% tbl_disp FILTER csv %] [% tbl_field_disp FILTER csv %]: [% tbl_disp FILTER csv %]
[% END %] [% END %]
[% IF row_field %] [% IF row_field && col_field %]
[% row_field_disp _ ' / ' _ col_field_disp FILTER csv %]
[% ELSIF row_field %]
[% row_field_disp FILTER csv %] [% row_field_disp FILTER csv %]
[% ELSE %]
[% col_field_disp FILTER csv %]
[% END %] [% END %]
[% " / " IF col_field AND row_field %]
[% col_field_disp FILTER csv %]
[% IF col_field -%] [% IF col_field -%]
[% FOREACH col = col_names -%] [% FOREACH col = col_names -%]
[% colsepchar %] [% colsepchar %]
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment