From 5347617ea3c120535d6557bbe7108bc3f75a8588 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Sun, 6 Sep 2026 03:58:46 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL]?= =?UTF-8?q?=20Fix=20CSV=20formula=20injection=20via=20NUL=20bytes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .jules/sentinel.md | 5 +++++ apps/desktop/src/lib/export.test.ts | 4 ++++ apps/desktop/src/lib/export.ts | 3 ++- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 34122c2b4..da69f5807 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -28,3 +28,8 @@ **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching. **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities. **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards. + +## 2026-09-06 - [Prevent CSV Formula Injection bypass via NUL bytes] +**Vulnerability:** The existing CSV formula injection regex (`/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/`) failed to account for payloads prefixed with NUL bytes (`\x00=cmd`). Spreadsheet software like Excel can ignore these NUL bytes and still execute the malicious formula. +**Learning:** Security validation regexes must explicitly guard against non-printable control characters that target downstream parsers. Even if these characters seem harmless in the application's runtime context, they can be weaponized in exported formats. +**Prevention:** When building explicit blocklists for malicious prefixes (such as =, +, -, @), always consider that control characters like `\x00` can act as transparent padding. The regex should be expanded to include these characters, ensuring robust sanitization while still explicitly ignoring ESLint's `no-control-regex` rule when appropriate. diff --git a/apps/desktop/src/lib/export.test.ts b/apps/desktop/src/lib/export.test.ts index 265e983d4..c3294d404 100644 --- a/apps/desktop/src/lib/export.test.ts +++ b/apps/desktop/src/lib/export.test.ts @@ -67,6 +67,10 @@ describe("export sanitization", () => { expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)"); expect(escapeCsvField("\n-100")).toBe("\"'\n-100\""); expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\""); + + // Prevent bypasses using NUL bytes + expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2"); + expect(escapeCsvField(" \x00@cmd")).toBe("' \x00@cmd"); }); it("handles combined scenarios: formula injection with structural characters", () => { diff --git a/apps/desktop/src/lib/export.ts b/apps/desktop/src/lib/export.ts index 3d4493b1d..52be02b8d 100644 --- a/apps/desktop/src/lib/export.ts +++ b/apps/desktop/src/lib/export.ts @@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string { export function escapeCsvField(value: string): string { let escapedValue = value; // Prevent CSV formula injection by prefixing problematic leading characters with a single quote - if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) { + // eslint-disable-next-line no-control-regex + if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/.test(value)) { escapedValue = `'${value}`; } // Enclose in double quotes if there's a comma, newline, or double quote