From 19497218525572474501429bbf4e00a31739f978 Mon Sep 17 00:00:00 2001 From: Jake Deery Date: Thu, 19 Feb 2026 12:22:30 +0000 Subject: [PATCH] Bug 41619: (Follow-up) Consider Logical Defined-Or in test This patch fixes xt/author/Text_CSV_Various.t by using a regex that can consider logical defined-or statements (|| and //, etc) when checking which formula has been used. TO TEST: a) run prove -vv xt/author/Text_CSV_Various.t *) notice the test fails == APPLY PATCH == b) repeat step a) *) notice the test now passes c) inspect diff for xt/author/Text_CSV_Various.t *) notice we are now using a wildcard (.*) between => and the first ' to skip variable declarations d) inspect diff for Koha/CSV.pm *) notice we are now hard-coding 'empty' as a defined-or in case someone decides not to define a format at the class level (which was not being done before anyway and is now defaulted to undefined) == SIGN OFF == --- Koha/CSV.pm | 4 ++-- xt/author/Text_CSV_Various.t | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Koha/CSV.pm b/Koha/CSV.pm index e64c80d128c..e8d9d806849 100644 --- a/Koha/CSV.pm +++ b/Koha/CSV.pm @@ -91,7 +91,7 @@ sub new { my $self = $class->SUPER::new( { binary => 1, # Always 1 for UTF-8 - formula => 'empty', # Always 'empty' for security + formula => undef, # Hard-coded to empty for security always_quote => $params->{always_quote} // 0, # Overridable eol => $params->{eol} // "\n", # Overridable sep_char => $sep_char, # From Koha config or override @@ -101,7 +101,7 @@ sub new { $self->{_csv} = Text::CSV_XS->new( { binary => $self->binary, - formula => $self->formula, + formula => $self->formula // 'empty', always_quote => $self->always_quote, eol => $self->eol, sep_char => $self->sep_char, diff --git a/xt/author/Text_CSV_Various.t b/xt/author/Text_CSV_Various.t index bfeb0d24b14..7d9656c797a 100755 --- a/xt/author/Text_CSV_Various.t +++ b/xt/author/Text_CSV_Various.t @@ -127,7 +127,7 @@ subtest 'CSV formula injection protection' => sub { for my $call (@new_calls) { # Check if this specific call has formula protection - unless ( $call =~ /formula\s*=>\s*['"](?:empty|die|croak|diag)['"]/ + unless ( $call =~ /formula\s*=>.*['"](?:empty|die|croak|diag)['"]/ || $call =~ /formula\s*=>\s*[1-5]/ ) { $has_unprotected = 1; -- 2.50.1 (Apple Git-155)