🛡️ Sentinel: [CRITICAL] Fix CSV formula injection via NUL bytes

.jules/sentinel.md

@@ -28,3 +28,8 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+
+## 2026-09-06 - [Prevent CSV Formula Injection bypass via NUL bytes]
+**Vulnerability:** The existing CSV formula injection regex (`/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/`) failed to account for payloads prefixed with NUL bytes (`\x00=cmd`). Spreadsheet software like Excel can ignore these NUL bytes and still execute the malicious formula.
+**Learning:** Security validation regexes must explicitly guard against non-printable control characters that target downstream parsers. Even if these characters seem harmless in the application's runtime context, they can be weaponized in exported formats.
+**Prevention:** When building explicit blocklists for malicious prefixes (such as =, +, -, @), always consider that control characters like `\x00` can act as transparent padding. The regex should be expanded to include these characters, ensuring robust sanitization while still explicitly ignoring ESLint's `no-control-regex` rule when appropriate.

apps/desktop/src/lib/export.test.ts

@@ -67,6 +67,10 @@ describe("export sanitization", () => {
       expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)");
       expect(escapeCsvField("\n-100")).toBe("\"'\n-100\"");
       expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\"");
+
+      // Prevent bypasses using NUL bytes
+      expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2");
+      expect(escapeCsvField(" \x00@cmd")).toBe("' \x00@cmd");
     });
 
     it("handles combined scenarios: formula injection with structural characters", () => {

apps/desktop/src/lib/export.ts

@@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string {
 export function escapeCsvField(value: string): string {
   let escapedValue = value;
   // Prevent CSV formula injection by prefixing problematic leading characters with a single quote
-  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) {
+  // eslint-disable-next-line no-control-regex
+  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/.test(value)) {
     escapedValue = `'${value}`;
   }
   // Enclose in double quotes if there's a comma, newline, or double quote