🛡️ Sentinel: [HIGH] Fix CSV formula injection null byte bypass

.jules/sentinel.md

@@ -28,3 +28,7 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+## 2026-08-24 - CSV Formula Injection Null Byte Bypass
+**Vulnerability:** Attackers could bypass the previous CSV formula injection mitigation (`=`, `+`, `-`, `@`) by prepending a null byte (`\x00`) to the payload. Some spreadsheet processors (like Excel) ignore the null byte and execute the subsequent formula.
+**Learning:** Checking for standard injection triggers and whitespace is sometimes insufficient for comprehensive CSV formula injection defense because spreadsheet applications often ignore non-printable control characters during evaluation.
+**Prevention:** Extend the CSV prefix-detection regex to also capture null bytes (`\x00`) alongside spaces, tabs, and newlines. Remember to bypass the `no-control-regex` linting rule using a directive comment (e.g., `// eslint-disable-next-line no-control-regex`).

apps/desktop/src/lib/export.test.ts

@@ -67,6 +67,8 @@ describe("export sanitization", () => {
       expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)");
       expect(escapeCsvField("\n-100")).toBe("\"'\n-100\"");
       expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\"");
+      expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2");
+      expect(escapeCsvField(" \x00@cmd")).toBe("' \x00@cmd");
     });
 
     it("handles combined scenarios: formula injection with structural characters", () => {

apps/desktop/src/lib/export.ts

@@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string {
 export function escapeCsvField(value: string): string {
   let escapedValue = value;
   // Prevent CSV formula injection by prefixing problematic leading characters with a single quote
-  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) {
+  // eslint-disable-next-line no-control-regex
+  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/.test(value)) {
     escapedValue = `'${value}`;
   }
   // Enclose in double quotes if there's a comma, newline, or double quote