From c182cf619727a5cc7c4ed601b16ffbcce32e594d Mon Sep 17 00:00:00 2001
From: "bzrmirror%bugzilla.org"
 <bzrmirror%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 6 Oct 2014 15:15:46 +0000
Subject: [PATCH] Bug 1054702: CSV export vulnerable to formulae injection
 r=glob,a=glob

git-svn-id: svn://10.0.0.236/trunk@265606 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev                         | 2 +-
 mozilla/webtools/bugzilla/.gitrev                         | 2 +-
 mozilla/webtools/bugzilla/Bugzilla/Template.pm            | 4 +++-
 .../template/en/default/reports/report-table.csv.tmpl     | 8 +++++---
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index b07e60ae646..09a493cf325 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-9162
\ No newline at end of file
+9163
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/.gitrev b/mozilla/webtools/bugzilla/.gitrev
index 4a2965e0106..8e0e610b593 100644
--- a/mozilla/webtools/bugzilla/.gitrev
+++ b/mozilla/webtools/bugzilla/.gitrev
@@ -1 +1 @@
-fa954ab78cc60aba43aedb85e2b4f98d56d7bf9d
\ No newline at end of file
+10e40c5707d383303c7837f526c3ab06466ede98
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/Template.pm b/mozilla/webtools/bugzilla/Bugzilla/Template.pm
index e4c1bf4608c..ca467577f37 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/Template.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/Template.pm
@@ -890,10 +890,12 @@ sub create {
             },
 
             # In CSV, quotes are doubled, and any value containing a quote or a
-            # comma is enclosed in quotes.
+            # comma is enclosed in quotes. If a field starts with an equals
+            # sign, it is proceed by a space.
             csv => sub
             {
                 my ($var) = @_;
+                $var = ' ' . $var if substr($var, 0, 1) eq '=';
                 $var =~ s/\"/\"\"/g;
                 if ($var !~ /^-?(\d+\.)?\d*$/) {
                     $var = "\"$var\"";
diff --git a/mozilla/webtools/bugzilla/template/en/default/reports/report-table.csv.tmpl b/mozilla/webtools/bugzilla/template/en/default/reports/report-table.csv.tmpl
index e2a92b51d24..e94014b9222 100644
--- a/mozilla/webtools/bugzilla/template/en/default/reports/report-table.csv.tmpl
+++ b/mozilla/webtools/bugzilla/template/en/default/reports/report-table.csv.tmpl
@@ -23,11 +23,13 @@
   [% END %]
   [% tbl_field_disp FILTER csv %]: [% tbl_disp FILTER csv %]
 [% END %]
-[% IF row_field %]
+[% IF row_field && col_field %]
+  [% row_field_disp _ ' / ' _ col_field_disp FILTER csv %]
+[% ELSIF row_field %]
   [% row_field_disp FILTER csv %]
+[% ELSE %]
+  [% col_field_disp FILTER csv %]
 [% END %]
-[% " / " IF col_field AND row_field %]
-[% col_field_disp FILTER csv %]
 [% IF col_field -%]
   [% FOREACH col = col_names -%]
     [% colsepchar %]