🛡️ Sentinel: [HIGH] CSV 수식 주입 방지 기능 우회(NUL 바이트) 취약점 수정

.jules/sentinel.md

@@ -28,3 +28,8 @@
 **Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
 **Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
 **Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.
+
+## 2026-08-26 - [Prevent CSV Formula Injection Bypasses using NUL byte]
+**Vulnerability:** CSV formula injection can be bypassed if malicious formulas are prefixed with a NUL byte (`\x00`), which causes standard regex patterns for leading characters like `=`, `+`, `-`, and `@` to miss the injection while spreadsheet software ignores the NUL byte and executes the formula.
+**Learning:** Security regexes for validating leading problematic characters in user inputs meant for CSVs must account for non-visible control characters like the NUL byte (`\x00`) that can obscure the start of a malicious string.
+**Prevention:** Include the NUL byte (`\x00`) in the regex character class meant to capture prefix/obscuring characters when escaping CSV inputs, e.g., `/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/`. Use `// eslint-disable-next-line no-control-regex` as needed to pass ESLint when adding control characters to regexes explicitly for security sanitization.

apps/desktop/src/lib/export.test.ts

@@ -67,6 +67,12 @@ describe("export sanitization", () => {
       expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)");
       expect(escapeCsvField("\n-100")).toBe("\"'\n-100\"");
       expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\"");
+
+      // Prevent bypasses using NUL bytes
+      expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2");
+      expect(escapeCsvField("\x00+SUM(A1)")).toBe("'\x00+SUM(A1)");
+      expect(escapeCsvField("\x00-100")).toBe("'\x00-100");
+      expect(escapeCsvField("\x00@cmd")).toBe("'\x00@cmd");
     });
 
     it("handles combined scenarios: formula injection with structural characters", () => {

apps/desktop/src/lib/export.ts

@@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string {
 export function escapeCsvField(value: string): string {
   let escapedValue = value;
   // Prevent CSV formula injection by prefixing problematic leading characters with a single quote
-  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) {
+  // eslint-disable-next-line no-control-regex
+  if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/.test(value)) {
     escapedValue = `'${value}`;
   }
   // Enclose in double quotes if there's a comma, newline, or double quote