🛡️ Sentinel: [HIGH] Fix CSV formula injection bypass with NUL byte

[seonghobae]

Succession result

이 PR의 유효한 production delta는 canonical desktop CSV security owner #1103에 이미 더 넓은 regression/contract와 함께 완전 승계되어 있어 별도 writer로 유지하지 않습니다.

#1163은 escapeCsvField의 기존 dangerous-prefix 정규식에 NUL(\x00)을 하나 추가하고 \x00some data 한 건을 회귀검증하는 3-file 변경입니다. #1103 exact head 2eb9bb2c50c1a20a6449bdc5e62ac898431d5a0b는 같은 NUL guard에 더해 repeated NUL, whitespace/BOM/NBSP + NUL, NUL-only cell, 그리고 현재 OWASP CSV Injection/WSTG가 명시하는 full-width formula operators ＝, ＋, －, ＠까지 동일한 export.ts boundary와 executable tests에서 소유합니다. 따라서 #1163에만 남는 유효 source/test/fixture/contract delta는 없습니다.

또한 이 PR의 HIGH/RCE 설명은 현재 authoritative evidence보다 강합니다. OWASP와 CWE-1236은 spreadsheet별 formula interpretation 차이를 명시하며 =, +, -, @, tab/CR/LF, locale-dependent full-width variants를 핵심 prefix로 다루지만 NUL-prefix가 보편적으로 제거되어 뒤의 formula를 실행한다고 확정하지 않습니다. #1103은 NUL 처리를 defense-in-depth로 보존하되 실제 severity는 harmless spreadsheet probes와 buyer-relevant application/locale evidence로 검증하도록 claim boundary를 교정했습니다.

Closed unmerged as fully technically succeeded by #1103. 이 branch의 checks/reviews/보안등급 주장은 #1103으로 이전하지 않습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

Next included review available in 45 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c2d9d7e0-d29f-4d00-80ef-1b413a6ac5ff

📥 Commits

Reviewing files that changed from the base of the PR and between 889d782 and 1fb2f5d.

📒 Files selected for processing (3)

• .jules/sentinel.md
• apps/desktop/src/lib/export.test.ts
• apps/desktop/src/lib/export.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}