From b4037900f92a5fab09276a3618350930439a092a Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Fri, 1 Aug 2025 12:03:17 -0300 Subject: [PATCH] [22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities This patch addresses CSV formula injection vulnerabilities by ensuring all Text::CSV instances use formula protection. Changes made: * Add formula => 'empty' to all Text::CSV constructors in: - Koha::Patrons::Import The 'empty' formula mode causes potentially dangerous formulas (starting with =, +, -, @) to be treated as empty strings rather than executed, preventing CSV injection attacks while maintaining data integrity. Security impact: * Prevents execution of malicious formulas in CSV imports * Protects against data exfiltration via CSV formula injection * Maintains backward compatibility for legitimate CSV data To test: 1. Apply the previous patch (author test) 2. Run: $ ktd --shell k$ prove xt/author/Text_CSV_Various.t => FAIL: Should show 1 file without formula protection 3. Apply this patch 4. Repeat 2 => SUCCESS: All tests should now pass 5. Try importing CSV with formula content (=cmd|"/c calc",test,data) => SUCCESS: Formula content is rejected/emptied, not executed 6. Import normal CSV data => SUCCESS: Normal data imports correctly 7. Sign off :-D Signed-off-by: David Cook Signed-off-by: Paul Derscheid Signed-off-by: wainuiwitikapark --- Koha/Patrons/Import.pm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Koha/Patrons/Import.pm b/Koha/Patrons/Import.pm index 6363ecfaa50..fc4a3420282 100644 --- a/Koha/Patrons/Import.pm +++ b/Koha/Patrons/Import.pm @@ -61,7 +61,8 @@ has 'today_iso' => ( is => 'ro', lazy => 1, default => sub { output_pref( { dt => dt_from_string(), dateonly => 1, dateformat => 'iso' } ); }, ); has 'text_csv' => ( is => 'rw', lazy => 1, - default => sub { Text::CSV->new( { binary => 1, } ); }, ); + default => sub { Text::CSV->new( { binary => 1, formula => 'empty' } ); }, +); sub import_patrons { my ($self, $params) = @_; -- 2.39.5