{{ message }}
Repository navigation
Neutralize formula injection in the SQL manager CSV export - #43083
Open
ManoharPaturi wants to merge 1 commit into
Open
ManoharPaturi wants to merge 1 commit into
ManoharPaturi wants to merge 1 commit into
Conversation
|
Hello @ManoharPaturi! This is your first pull request on PrestaShop repository of the PrestaShop project. Thank you, and welcome to this Open Source community! |
ps-jarvis
added
Improvement
ExportCsvFileWriter writes the rows of a SQL manager export into the CSV file exactly as the database returned them. A saved request that selects text written by a customer, such as a message or an address field, can therefore place a value starting with =, +, -, @, a tab or a carriage return into the file, and whoever opens the export in a spreadsheet application executes it as a formula. The streamed CSV exports already neutralize those leading characters in CsvResponse::sanitizeRow. This applies the same policy to the file based export path, on the title row and on every data row, so both export components behave the same way.
ManoharPaturi
force-pushed
the
sanitize-sql-manager-csv-export
branch
from
October 4, 2026 02:39
9442c75 to
d9fef21
Compare
Author
|
Thank you for the pointers. The pull request is now based on develop, the description table is filled in, and a matching issue has been opened and linked in the description. Please let me know if anything else is needed. |
Hlavtox
requested changes
Oct 6, 2026
Hlavtox
left a comment
Hlavtox
left a comment
Member
There was a problem hiding this comment.
Nonsense, formulas have nothing to do with CSV. CSV can be opened in a text editor.
ps-jarvis
added
the
Waiting for author
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The SQL manager CSV export writes each cell value through
fputcsv()without inspecting the content. When a query result cell begins with=,+,-,@, a tab or a carriage return, spreadsheet applications interpret the cell as a formula when the exported file is opened, which is the classic CSV injection pattern. PrestaShop already neutralizes this pattern in other export paths, and the published advisory about CSV injection in exports describes the same prefix set.This change neutralizes leading formula characters in the SQL manager export by prefixing an apostrophe when a cell value starts with one of those characters, matching the approach used elsewhere in the project.
How to test
In the advanced parameters SQL manager, run a query returning a value that starts with
=SUM(1+1)and export the result as CSV. Open the file in a spreadsheet application: the cell shows the literal text instead of evaluating a formula. Values without leading formula characters are unchanged.Verified with
php -land by comparingfputcsvoutput for a matrix of cell values before and after the change: only cells with leading= + - @, tab or carriage return gain the apostrophe prefix.Fixes #43088