{{ message }}
Repository navigation
Neutralize formula injection in the legacy admin list export - #43084
Open
ManoharPaturi wants to merge 1 commit into
Open
ManoharPaturi wants to merge 1 commit into
ManoharPaturi wants to merge 1 commit into
Conversation
|
Hello @ManoharPaturi! This is your first pull request on PrestaShop repository of the PrestaShop project. Thank you, and welcome to this Open Source community! |
ps-jarvis
added
Improvement
AdminController::processExport writes the admin list to a CSV response without inspecting the values, while the streamed exports already neutralize values starting with =, +, -, @, a tab or a carriage return in CsvResponse, and the module statistics export does the same in ModuleGraph::escapeCell. A legacy controller that enables allow_export, which module controllers still do, exports database text written by customers, so the file handed to the employee can carry a formula that a spreadsheet application executes on open. The header row and every field value now go through the same policy as the other export components.
ManoharPaturi
force-pushed
the
sanitize-legacy-list-export
branch
from
October 4, 2026 02:39
9f1a498 to
2ab8860
Compare
Author
|
Thank you for the pointers. The pull request is now based on develop, the description table is filled in, and a matching issue has been opened and linked in the description. Please let me know if anything else is needed. |
Hlavtox
requested changes
Oct 6, 2026
Hlavtox
left a comment
Hlavtox
left a comment
Member
There was a problem hiding this comment.
Nonsense, formulas have nothing to do with CSV. CSV can be opened in a text editor.
ps-jarvis
added
the
Waiting for author
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The legacy admin list export (
AdminController::processExport()to the CSV writer) writes field values without inspecting the content, so a list field beginning with=,+,-,@, a tab or a carriage return becomes a formula when the exported CSV is opened in a spreadsheet application, the same CSV injection pattern already handled in newer export paths.This change neutralizes those leading characters in the legacy export path as well, so every admin list CSV export is consistent with the protection the project already applies elsewhere.
How to test
Add a product (or any list entity) whose name begins with
=SUM(1+1)and export the corresponding admin list as CSV. Open the file in a spreadsheet application: the cell shows the literal text. Exporting lists with ordinary values produces byte identical output to before.Verified with
php -land by comparing export output before and after for a set of names with and without leading formula characters.Fixes #43089