Bugzilla – Attachment 185785 Details for
Bug 40579
CSV formula injection protection
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities
2211x-Bug-40579-Fix-CSV-formula-injection-vulnerab.patch (text/plain), 2.12 KB, created by
Wainui Witika-Park
on 2025-08-26 04:10:42 UTC
(
hide
)
Description:
[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities
Filename:
MIME Type:
Creator:
Wainui Witika-Park
Created:
2025-08-26 04:10:42 UTC
Size:
2.12 KB
patch
obsolete
>From b4037900f92a5fab09276a3618350930439a092a Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Fri, 1 Aug 2025 12:03:17 -0300 >Subject: [PATCH] [22.11.x] Bug 40579: Fix CSV formula injection > vulnerabilities > >This patch addresses CSV formula injection vulnerabilities by ensuring >all Text::CSV instances use formula protection. > >Changes made: >* Add formula => 'empty' to all Text::CSV constructors in: > - Koha::Patrons::Import > >The 'empty' formula mode causes potentially dangerous formulas (starting >with =, +, -, @) to be treated as empty strings rather than executed, >preventing CSV injection attacks while maintaining data integrity. > >Security impact: >* Prevents execution of malicious formulas in CSV imports >* Protects against data exfiltration via CSV formula injection >* Maintains backward compatibility for legitimate CSV data > >To test: >1. Apply the previous patch (author test) >2. Run: > $ ktd --shell > k$ prove xt/author/Text_CSV_Various.t >=> FAIL: Should show 1 file without formula protection >3. Apply this patch >4. Repeat 2 >=> SUCCESS: All tests should now pass >5. Try importing CSV with formula content (=cmd|"/c calc",test,data) >=> SUCCESS: Formula content is rejected/emptied, not executed >6. Import normal CSV data >=> SUCCESS: Normal data imports correctly >7. Sign off :-D > >Signed-off-by: David Cook <dcook@prosentient.com.au> >Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de> >Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz> >--- > Koha/Patrons/Import.pm | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > >diff --git a/Koha/Patrons/Import.pm b/Koha/Patrons/Import.pm >index 6363ecfaa50..fc4a3420282 100644 >--- a/Koha/Patrons/Import.pm >+++ b/Koha/Patrons/Import.pm >@@ -61,7 +61,8 @@ has 'today_iso' => ( is => 'ro', lazy => 1, > default => sub { output_pref( { dt => dt_from_string(), dateonly => 1, dateformat => 'iso' } ); }, ); > > has 'text_csv' => ( is => 'rw', lazy => 1, >- default => sub { Text::CSV->new( { binary => 1, } ); }, ); >+ default => sub { Text::CSV->new( { binary => 1, formula => 'empty' } ); }, >+); > > sub import_patrons { > my ($self, $params) = @_; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40579
:
185034
|
185035
|
185078
|
185079
|
185737
|
185738
|
185783
|
185784
| 185785 |
185796
|
185797
|
185798
|
185799
|
185800
|
185801