Skip to content

🛡️ Sentinel: [CRITICAL] Fix CSV formula injection NUL byte bypass #988

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 1 commit into from
Closed

🛡️ Sentinel: [CRITICAL] Fix CSV formula injection NUL byte bypass #988

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,3 +28,8 @@
**Vulnerability:** The Rust backend (`apps/desktop/src-tauri/src/main.rs`) did not enforce a maximum URL length limit when processing YouTube URLs via `import_youtube_url`. While the frontend enforced `MAX_YOUTUBE_URL_LENGTH = 2000` via the input element, this could be bypassed by an attacker sending requests directly to the Tauri backend API, potentially causing a Denial of Service (DoS) due to unbounded URL parsing and regex matching.
**Learning:** Input validation must occur at the entry point of untrusted data on the backend, even if it is also validated on the frontend. Relying solely on frontend validation for constraints like string length can expose the backend to resource exhaustion vulnerabilities.
**Prevention:** Always enforce constraints like maximum length, format validation, and sanitization at the earliest possible point on the backend, typically at the API boundary, regardless of frontend safeguards.

## 2024-05-18 - CSV Formula Injection NUL byte bypass
**Vulnerability:** CSV formula injection mitigation missed NUL byte (\x00) prefix bypasses.
**Learning:** Excel and other spreadsheet programs may ignore NUL bytes before formula execution characters, allowing attackers to bypass standard regex checks.
**Prevention:** Include \x00 in the regex character class for leading whitespace/control characters when sanitizing CSV fields.
1 change: 1 addition & 0 deletions apps/desktop/src/lib/export.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ describe("export sanitization", () => {
expect(escapeCsvField("\t+SUM(A1)")).toBe("'\t+SUM(A1)");
expect(escapeCsvField("\n-100")).toBe("\"'\n-100\"");
expect(escapeCsvField("\r@cmd")).toBe("\"'\r@cmd\"");
expect(escapeCsvField("\x00=1+2")).toBe("'\x00=1+2");
});

it("handles combined scenarios: formula injection with structural characters", () => {
Expand Down
3 changes: 2 additions & 1 deletion apps/desktop/src/lib/export.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ export function sanitizeFilename(title: string): string {
export function escapeCsvField(value: string): string {
let escapedValue = value;
// Prevent CSV formula injection by prefixing problematic leading characters with a single quote
if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/.test(value)) {
// eslint-disable-next-line no-control-regex
if (/^[\s\uFEFF\xA0]*[=+\-@\t\r\n\x00]/.test(value)) {

@devin-ai-integration devin-ai-integration Bot Aug 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: NUL added to trigger class, not leading class

\x00 was added to the trigger character class at export.ts rather than the leading-whitespace class named in the sentinel note. All NUL-prefix bypasses are still caught. One harmless side effect: a benign value like \x00hello now gets quote-prefixed.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

escapedValue = `'${value}`;
}
// Enclose in double quotes if there's a comma, newline, or double quote
Expand Down
Loading