Bugzilla – Attachment 193461 Details for
Bug 41619
Add `Koha::CSV`
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 41619: (Follow-up) Consider Logical Defined-Or in test
1949721.patch (text/plain), 2.81 KB, created by
Jake Deery
on 2026-02-19 12:39:00 UTC
(
hide
)
Description:
Bug 41619: (Follow-up) Consider Logical Defined-Or in test
Filename:
MIME Type:
Creator:
Jake Deery
Created:
2026-02-19 12:39:00 UTC
Size:
2.81 KB
patch
obsolete
>From 19497218525572474501429bbf4e00a31739f978 Mon Sep 17 00:00:00 2001 >From: Jake Deery <jake.deery@openfifth.co.uk> >Date: Thu, 19 Feb 2026 12:22:30 +0000 >Subject: [PATCH] Bug 41619: (Follow-up) Consider Logical Defined-Or in test > >This patch fixes xt/author/Text_CSV_Various.t by using a regex that can consider logical defined-or statements (|| and //, etc) when checking which formula has been used. > >TO TEST: >a) run prove -vv xt/author/Text_CSV_Various.t > *) notice the test fails >== APPLY PATCH == >b) repeat step a) > *) notice the test now passes >c) inspect diff for xt/author/Text_CSV_Various.t > *) notice we are now using a wildcard (.*) between => and the first ' to skip variable declarations >d) inspect diff for Koha/CSV.pm > *) notice we are now hard-coding 'empty' as a defined-or in case someone decides not to define a format at the class level > (which was not being done before anyway and is now defaulted to undefined) >== SIGN OFF == >--- > Koha/CSV.pm | 4 ++-- > xt/author/Text_CSV_Various.t | 2 +- > 2 files changed, 3 insertions(+), 3 deletions(-) > >diff --git a/Koha/CSV.pm b/Koha/CSV.pm >index e64c80d128c..e8d9d806849 100644 >--- a/Koha/CSV.pm >+++ b/Koha/CSV.pm >@@ -91,7 +91,7 @@ sub new { > my $self = $class->SUPER::new( > { > binary => 1, # Always 1 for UTF-8 >- formula => 'empty', # Always 'empty' for security >+ formula => undef, # Hard-coded to empty for security > always_quote => $params->{always_quote} // 0, # Overridable > eol => $params->{eol} // "\n", # Overridable > sep_char => $sep_char, # From Koha config or override >@@ -101,7 +101,7 @@ sub new { > $self->{_csv} = Text::CSV_XS->new( > { > binary => $self->binary, >- formula => $self->formula, >+ formula => $self->formula // 'empty', > always_quote => $self->always_quote, > eol => $self->eol, > sep_char => $self->sep_char, >diff --git a/xt/author/Text_CSV_Various.t b/xt/author/Text_CSV_Various.t >index bfeb0d24b14..7d9656c797a 100755 >--- a/xt/author/Text_CSV_Various.t >+++ b/xt/author/Text_CSV_Various.t >@@ -127,7 +127,7 @@ subtest 'CSV formula injection protection' => sub { > for my $call (@new_calls) { > > # Check if this specific call has formula protection >- unless ( $call =~ /formula\s*=>\s*['"](?:empty|die|croak|diag)['"]/ >+ unless ( $call =~ /formula\s*=>.*['"](?:empty|die|croak|diag)['"]/ > || $call =~ /formula\s*=>\s*[1-5]/ ) > { > $has_unprotected = 1; >-- >2.50.1 (Apple Git-155) >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 41619
:
191466
|
191491
|
191551
| 193461