Bug 40579 - CSV formula injection protection
Summary: CSV formula injection protection
Status: Passed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Tomás Cohen Arazi (tcohen)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-08-01 14:31 UTC by Tomás Cohen Arazi (tcohen)
Modified: 2025-08-27 08:55 UTC (History)
17 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.03,24.11.08,24.05.13,22.11.30
Circulation function:


Attachments
Bug 40579: Add author test for CSV formula injection protection (3.84 KB, patch)
2025-08-01 15:05 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40579: Fix CSV formula injection vulnerabilities (4.06 KB, patch)
2025-08-01 15:05 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 40579: Add author test for CSV formula injection protection (3.89 KB, patch)
2025-08-04 00:16 UTC, David Cook
Details | Diff | Splinter Review
Bug 40579: Fix CSV formula injection vulnerabilities (4.11 KB, patch)
2025-08-04 00:16 UTC, David Cook
Details | Diff | Splinter Review
Bug 40579: Add author test for CSV formula injection protection (3.95 KB, patch)
2025-08-25 11:42 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 40579: Fix CSV formula injection vulnerabilities (4.17 KB, patch)
2025-08-25 11:42 UTC, Paul Derscheid
Details | Diff | Splinter Review
[22.11.x] Bug 40579: Add author test for CSV formula injection protection (3.95 KB, patch)
2025-08-26 04:09 UTC, Wainui Witika-Park
Details | Diff | Splinter Review
[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities (2.06 KB, patch)
2025-08-26 04:09 UTC, Wainui Witika-Park
Details | Diff | Splinter Review
[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities (2.12 KB, patch)
2025-08-26 04:10 UTC, Wainui Witika-Park
Details | Diff | Splinter Review
[24.05.x] Bug 40579: Add author test for CSV formula injection protection (3.92 KB, patch)
2025-08-26 15:59 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 40579: Fix CSV formula injection vulnerabilities (4.32 KB, patch)
2025-08-26 15:59 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 40579: Add author test for CSV formula injection protection (3.95 KB, patch)
2025-08-26 16:06 UTC, Paul Derscheid
Details | Diff | Splinter Review
Bug 40579: Fix CSV formula injection vulnerabilities (4.17 KB, patch)
2025-08-26 16:06 UTC, Paul Derscheid
Details | Diff | Splinter Review
[24.05.x] Bug 40579: Add author test for CSV formula injection protection (3.93 KB, patch)
2025-08-26 16:08 UTC, Paul Derscheid
Details | Diff | Splinter Review
[24.05.x] Bug 40579: Fix CSV formula injection vulnerabilities (4.33 KB, patch)
2025-08-26 16:08 UTC, Paul Derscheid
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi (tcohen) 2025-08-01 14:31:35 UTC
There are a couple places where formula injection can happen. This are mostly new modules. A guideline should be put in place, and a QA check too.

* Koha/Patrons/Import.pm
* Koha/BackgroundJob/ImportKBARTFile.pm
* Koha/ERM/EUsage/CounterFile.pm
Comment 1 Tomás Cohen Arazi (tcohen) 2025-08-01 15:05:55 UTC
Created attachment 185034 [details] [review]
Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Comment 2 Tomás Cohen Arazi (tcohen) 2025-08-01 15:05:58 UTC
Created attachment 185035 [details] [review]
Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D
Comment 3 David Cook 2025-08-04 00:16:05 UTC
Created attachment 185078 [details] [review]
Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 4 David Cook 2025-08-04 00:16:09 UTC
Created attachment 185079 [details] [review]
Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 5 David Cook 2025-08-04 00:17:48 UTC
Signed Off

There's not enough info to do manual tests, but the unit tests work and the code change itself looks good.
Comment 6 Paul Derscheid 2025-08-25 11:42:56 UTC
Created attachment 185737 [details] [review]
Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 7 Paul Derscheid 2025-08-25 11:42:59 UTC
Created attachment 185738 [details] [review]
Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 8 Paul Derscheid 2025-08-25 11:46:08 UTC
While I think this is comparatively hard to exploit (at least in Patron import, where I tested it), Tomás patches address it correctly and the test for detection is good!

Definitely a nice improvement. Would you also write that guideline, Tomás?
Comment 9 Wainui Witika-Park 2025-08-26 02:12:00 UTC
Is this required for 22.11.x? 

The following files don't exist in 22.11.x:

* Koha/BackgroundJob/ImportKBARTFile.pm
* Koha/ERM/EUsage/CounterFile.pm

But this one does:

* Koha/Patrons/Import.pm
Comment 10 Wainui Witika-Park 2025-08-26 04:09:32 UTC
Created attachment 185783 [details] [review]
[22.11.x] Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Comment 11 Wainui Witika-Park 2025-08-26 04:09:57 UTC
Created attachment 185784 [details] [review]
[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 1 file without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 12 Wainui Witika-Park 2025-08-26 04:10:42 UTC
Created attachment 185785 [details] [review]
[22.11.x] Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 1 file without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
Comment 13 Wainui Witika-Park 2025-08-26 04:11:39 UTC
(In reply to Wainui Witika-Park from comment #9)
> Is this required for 22.11.x? 
> 
> The following files don't exist in 22.11.x:
> 
> * Koha/BackgroundJob/ImportKBARTFile.pm
> * Koha/ERM/EUsage/CounterFile.pm
> 
> But this one does:
> 
> * Koha/Patrons/Import.pm

Ok I just rebased the patches to take out the first 2 files and only keep in changes for Koha/Patrons/Import.pm
Comment 14 Wainui Witika-Park 2025-08-26 05:38:08 UTC
(In reply to Wainui Witika-Park from comment #13)
> (In reply to Wainui Witika-Park from comment #9)
> > Is this required for 22.11.x? 
> > 
> > The following files don't exist in 22.11.x:
> > 
> > * Koha/BackgroundJob/ImportKBARTFile.pm
> > * Koha/ERM/EUsage/CounterFile.pm
> > 
> > But this one does:
> > 
> > * Koha/Patrons/Import.pm
> 
> Ok I just rebased the patches to take out the first 2 files and only keep in
> changes for Koha/Patrons/Import.pm

Applied the 22.11.x patches to 22.11.x-security for 22.11.30
Comment 15 Jesse Maseto 2025-08-26 14:00:18 UTC
This doesn't apply to 24.05.x. Merge conflicts. Please resolve.
Comment 16 Paul Derscheid 2025-08-26 15:59:31 UTC
Created attachment 185796 [details] [review]
[24.05.x] Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 17 Paul Derscheid 2025-08-26 15:59:33 UTC
Created attachment 185797 [details] [review]
Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 18 Paul Derscheid 2025-08-26 16:00:51 UTC
Damn, something went wrong when attaching. Fixing..
Comment 19 Paul Derscheid 2025-08-26 16:06:04 UTC
Created attachment 185798 [details] [review]
Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 20 Paul Derscheid 2025-08-26 16:06:07 UTC
Created attachment 185799 [details] [review]
Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 21 Paul Derscheid 2025-08-26 16:08:02 UTC
Created attachment 185800 [details] [review]
[24.05.x] Bug 40579: Add author test for CSV formula injection protection

This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.

The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
   - Koha/Patrons/Import.pm
   - Koha/BackgroundJob/ImportKBARTFile.pm
   - Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 22 Paul Derscheid 2025-08-26 16:08:05 UTC
Created attachment 185801 [details] [review]
[24.05.x] Bug 40579: Fix CSV formula injection vulnerabilities

This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.

Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
  - Koha::Patrons::Import
  - Koha::BackgroundJob::ImportKBARTFile
  - Koha::ERM::EUsage::CounterFile

The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.

Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data

To test:
1. Apply the previous patch (author test)
2. Run:
   $ ktd --shell
  k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Comment 23 Paul Derscheid 2025-08-26 16:08:54 UTC
Alright, fixed and added rebased versions for 24.05.x as well. Sorry for the mess.
Comment 24 Paul Derscheid 2025-08-27 08:55:26 UTC
Applied to 25.05.x-security for 25.05.03.