From 930eca395aeb03548d73638524a701c88003df0d Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 1 Sep 2026 04:03:32 +0000
Subject: [PATCH] Fix CSV formula injection NUL byte bypass

---
 .jules/sentinel.md                  | 4 ++++
 apps/desktop/src/lib/export.test.ts | 3 +++
 apps/desktop/src/lib/export.ts      | 3 ++-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 34122c2b4..60259a2cb 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -28,3 +28,7 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+## 2026-09-01 - CSV Formula Injection NUL byte bypass
+**Vulnerability:** The regex mitigation for CSV formula injection in `escapeCsvField` accounted for structural characters and whitespaces but lacked explicit coverage for control characters like the NUL byte (`\x00`).
+**Learning:** The NUL byte can be used by an attacker to bypass naive sanitization regex checks because some spreadsheet software ignores leading NUL bytes while still parsing subsequent formula characters.
+**Prevention:** Extend regex mitigation rules to explicitly match and block leading NUL bytes (`\x00`), employing `eslint-disable-next-line no-control-regex` to cleanly permit the control character in the JS source.
diff --git a/apps/desktop/src/lib/export.test.ts b/apps/desktop/src/lib/export.test.ts
index 265e983d4..cceaf2e6f 100644
--- a/apps/desktop/src/lib/export.test.ts
+++ b/apps/desktop/src/lib/export.test.ts
@@ -67,6 +67,9 @@ describe("export sanitization", () => {
       expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)");
       expect(escapeCsvField("\n-100")).toBe("\"'\n-100\"");
       expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\"");
+      expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2");
+      expect(escapeCsvField("\x00@cmd")).toBe("'\x00@cmd");
+      expect(escapeCsvField("\x00")).toBe("'\x00");
     });
 
     it("handles combined scenarios: formula injection with structural characters", () => {
diff --git a/apps/desktop/src/lib/export.ts b/apps/desktop/src/lib/export.ts
index 3d4493b1d..1efda8bc7 100644
--- a/apps/desktop/src/lib/export.ts
+++ b/apps/desktop/src/lib/export.ts
@@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string {
 export function escapeCsvField(value: string): string {
   let escapedValue = value;
   // Prevent CSV formula injection by prefixing problematic leading characters with a single quote
-  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) {
+  // eslint-disable-next-line no-control-regex
+  if (/^[\s\uFEFF\xA0\x00]*[=+\-@\t\r\n\x00]/.test(value)) {
     escapedValue = `'${value}`;
   }
   // Enclose in double quotes if there's a comma, newline, or double quote