From 29a51dbece4a21d9312ff77046a7fcdf46a041ec Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Thu, 3 Sep 2026 04:04:28 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Update=20se?= =?UTF-8?q?ntinel.md=20with=20NUL=20byte=20bypass=20learning?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .jules/sentinel.md | 5 +++++ apps/desktop/src/lib/export.test.ts | 3 +++ apps/desktop/src/lib/export.ts | 3 ++- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 34122c2b4..b7503120a 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -28,3 +28,8 @@ **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching. **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities. **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards. + +## 2026-09-03 - NUL byte CSV Formula Injection Bypass +**Vulnerability:** The CSV formula injection mitigation in the export module missed checking for the NUL byte (`\x00`). +**Learning:** Checking for `[=+\-@\t\r\n]` is insufficient, because an attacker could prepend a NUL byte which bypasses the check but is still evaluated by applications like Excel. +**Prevention:** Include the NUL byte `\x00` in the regex character class checking for problematic leading characters, and explicitly disable the `no-control-regex` ESLint rule for that specific regex instance to allow the code to pass linting. diff --git a/apps/desktop/src/lib/export.test.ts b/apps/desktop/src/lib/export.test.ts index 265e983d4..aa90f7dce 100644 --- a/apps/desktop/src/lib/export.test.ts +++ b/apps/desktop/src/lib/export.test.ts @@ -67,6 +67,9 @@ describe("export sanitization", () => { expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)"); expect(escapeCsvField("\n-100")).toBe("\"'\n-100\""); expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\""); + expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2"); + expect(escapeCsvField("\x00cmd")).toBe("'\x00cmd"); + expect(escapeCsvField(" \x00@cmd")).toBe("' \x00@cmd"); }); it("handles combined scenarios: formula injection with structural characters", () => { diff --git a/apps/desktop/src/lib/export.ts b/apps/desktop/src/lib/export.ts index 3d4493b1d..52be02b8d 100644 --- a/apps/desktop/src/lib/export.ts +++ b/apps/desktop/src/lib/export.ts @@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string { export function escapeCsvField(value: string): string { let escapedValue = value; // Prevent CSV formula injection by prefixing problematic leading characters with a single quote - if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) { + // eslint-disable-next-line no-control-regex + if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/.test(value)) { escapedValue = `'${value}`; } // Enclose in double quotes if there's a comma, newline, or double quote