🛡️ Sentinel: [HIGH] CSV 수식 주입 방지 기능 우회(NUL 바이트) 취약점 수정

[seonghobae]

🚨 심각도: HIGH (고위험)
💡 취약점: CSV 내보내기 시 악의적인 사용자가 입력값 앞에 NUL 바이트(\x00)를 추가하여 =, +, -, @ 문자를 난독화할 수 있습니다. 기존의 CSV 수식 주입 방지 정규식은 이를 탐지하지 못하지만, Excel 등의 스프레드시트 프로그램은 NUL 바이트를 무시하고 뒤따르는 수식을 실행합니다.
🎯 영향: 악성 수식 주입을 통해 임의 코드 실행이나 정보 유출이 발생할 수 있습니다.
🔧 해결: apps/desktop/src/lib/export.ts의 escapeCsvField 함수 내 정규식 클래스에 NUL 바이트(\x00)를 명시적으로 추가하여, 해당 문자로 시작하는 입력값도 안전하게 이스케이프 처리하도록 개선했습니다.
✅ 검증: apps/desktop/src/lib/export.test.ts에 NUL 바이트를 활용한 우회 시도를 차단하는 단위 테스트를 추가하고 모든 테스트를 통과함을 확인했습니다.

---

PR created automatically by Jules for task 5296523471095022614 started by @seonghobae

---

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

Next included review available in 43 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d21e5b4-d19a-458a-95da-aff25458bba1

📥 Commits

Reviewing files that changed from the base of the PR and between 7ad56cf and 6e1eaa2.

📒 Files selected for processing (3)

• .jules/sentinel.md
• apps/desktop/src/lib/export.test.ts
• apps/desktop/src/lib/export.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Closing as an exact semantic duplicate of the canonical CSV-security owner #941 after fresh head/diff comparison.

Current identities immediately before this state change:

• 🛡️ Sentinel: [HIGH] CSV 수식 주입 방지 기능 우회(NUL 바이트) 취약점 수정 #1035: 6e1eaa2e69ee61f64d4ebd3c52c318ce6cafbb75
• 🛡️ Sentinel: CSV 수식 주입 NUL·전각 연산자 우회 차단 #941: cedf35aa34f62f92c09d92b3a3d36c857b61e5f8
• protected develop: 7ad56cf0065d068ec6463d92726de4855a6e201d

#1035's production delta only adds \x00 to the older ^[\s\uFEFF\xA0]*... formula-prefix regex and adds four NUL+ASCII-operator tests. #941 already owns that behavior and a strictly stronger boundary: NUL itself is dangerous, TAB/CR/LF/FF/VT are not swallowed by \s*, full-width spreadsheet operators are covered, spacing/BOM handling is explicit, and the regression suite includes direct control-token cases plus NUL/operator cases. #941 also carries the doctoring/traceability for this trust boundary. #1035 has no unique buyer-visible or security behavior worth preserving; .jules/sentinel.md is task metadata, not independent production authority.

Keeping #1035 open would create a competing writer for the same security boundary and could regress #941's stronger first-effective-token contract. Preserve CSV formula-injection authority on #941; no changes from #1035 are being merged.

[google-labs-jules]

Closing as an exact semantic duplicate of the canonical CSV-security owner #941 after fresh head/diff comparison.

Current identities immediately before this state change:

• 🛡️ Sentinel: [HIGH] CSV 수식 주입 방지 기능 우회(NUL 바이트) 취약점 수정 #1035: 6e1eaa2e69ee61f64d4ebd3c52c318ce6cafbb75
• 🛡️ Sentinel: CSV 수식 주입 NUL·전각 연산자 우회 차단 #941: cedf35aa34f62f92c09d92b3a3d36c857b61e5f8
• protected develop: 7ad56cf0065d068ec6463d92726de4855a6e201d

#1035's production delta only adds \x00 to the older ^[\s\uFEFF\xA0]*... formula-prefix regex and adds four NUL+ASCII-operator tests. #941 already owns that behavior and a strictly stronger boundary: NUL itself is dangerous, TAB/CR/LF/FF/VT are not swallowed by \s*, full-width spreadsheet operators are covered, spacing/BOM handling is explicit, and the regression suite includes direct control-token cases plus NUL/operator cases. #941 also carries the doctoring/traceability for this trust boundary. #1035 has no unique buyer-visible or security behavior worth preserving; .jules/sentinel.md is task metadata, not independent production authority.

Keeping #1035 open would create a competing writer for the same security boundary and could regress #941's stronger first-effective-token contract. Preserve CSV formula-injection authority on #941; no changes from #1035 are being merged.

Understood. Acknowledging that this work is now an exact semantic duplicate and stopping work on this task.