View | Details | Raw Unified | Return to bug 41619
Collapse All | Expand All

(-)a/Koha/CSV.pm (-2 / +2 lines)
Lines 91-97 sub new { Link Here
91
    my $self = $class->SUPER::new(
91
    my $self = $class->SUPER::new(
92
        {
92
        {
93
            binary       => 1,                                  # Always 1 for UTF-8
93
            binary       => 1,                                  # Always 1 for UTF-8
94
            formula      => 'empty',                            # Always 'empty' for security
94
            formula      => undef,                              # Hard-coded to empty for security
95
            always_quote => $params->{always_quote} // 0,       # Overridable
95
            always_quote => $params->{always_quote} // 0,       # Overridable
96
            eol          => $params->{eol}          // "\n",    # Overridable
96
            eol          => $params->{eol}          // "\n",    # Overridable
97
            sep_char     => $sep_char,                          # From Koha config or override
97
            sep_char     => $sep_char,                          # From Koha config or override
Lines 101-107 sub new { Link Here
101
    $self->{_csv} = Text::CSV_XS->new(
101
    $self->{_csv} = Text::CSV_XS->new(
102
        {
102
        {
103
            binary       => $self->binary,
103
            binary       => $self->binary,
104
            formula      => $self->formula,
104
            formula      => $self->formula // 'empty',
105
            always_quote => $self->always_quote,
105
            always_quote => $self->always_quote,
106
            eol          => $self->eol,
106
            eol          => $self->eol,
107
            sep_char     => $self->sep_char,
107
            sep_char     => $self->sep_char,
(-)a/xt/author/Text_CSV_Various.t (-2 / +1 lines)
Lines 127-133 subtest 'CSV formula injection protection' => sub { Link Here
127
            for my $call (@new_calls) {
127
            for my $call (@new_calls) {
128
128
129
                # Check if this specific call has formula protection
129
                # Check if this specific call has formula protection
130
                unless ( $call =~ /formula\s*=>\s*['"](?:empty|die|croak|diag)['"]/
130
                unless ( $call =~ /formula\s*=>.*['"](?:empty|die|croak|diag)['"]/
131
                    || $call =~ /formula\s*=>\s*[1-5]/ )
131
                    || $call =~ /formula\s*=>\s*[1-5]/ )
132
                {
132
                {
133
                    $has_unprotected = 1;
133
                    $has_unprotected = 1;
134
- 

Return to bug 41619