4b29cedfa68e
neutralize leading ; in csvSafe (regional formula separator) (audit #11)
- time
- 2026-08-21 04:11 UTC · 2 months ago
- machine
- koh2
- agent
- glm-5.2
- session
- audit 2026-08-20 remediation
- parent
- 56a46737c4aa
↓ peach-browser-4b29cedf.tar.gzatlas at this save
files changed2 files
src/popup/views/Export.csv.test.ts+1 −1src/popup/views/Export.tsx+1 −1src/popup/views/Export.csv.test.ts+1 −1
@@ -5,7 +5,7 @@55 66 describe("csvSafe — CSV/spreadsheet formula-injection neutralization (audit MEDIUM)", () => {77 it("prefixes formula-trigger leading characters with a quote", () => {8- for (const lead of ["=", "+", "-", "@", "\t", "\r"]) {8+ for (const lead of ["=", "+", "-", "@", ";", "\t", "\r"]) {99 expect(csvSafe(lead + "HYPERLINK(\"http://evil\")")).toBe("'" + lead + "HYPERLINK(\"http://evil\")");1010 }1111 });src/popup/views/Export.tsx+1 −1
@@ -505,7 +505,7 @@505505 // in the exported CSV could exfiltrate other plaintext cells on open. Prefix506506 // any such field with a single quote so the cell is treated as text (audit MEDIUM).507507 export function csvSafe(value: string): string {508- return /^[=+\-@\t\r]/.test(value) ? "'" + value : value;508+ return /^[=+\-;@\t\r]/.test(value) ? "'" + value : value;509509 }510510 511511 function buildCsv(entries: VaultEntry[]): string {