Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1054702: CSV export vulnerable to formulae injection

Browse Source 
r=glob,a=glob


git-svn-id: svn://10.0.0.236/trunk@265606 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzrmirror%bugzilla.org 2014-10-06 15:15:46 +00:00
parent d4a0f53c33
commit c182cf6197
4 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@ -1 +1 @@
9162 9163

2
mozilla/webtools/bugzilla/.gitrev
View File

@ -1 +1 @@
fa954ab78cc60aba43aedb85e2b4f98d56d7bf9d 10e40c5707d383303c7837f526c3ab06466ede98

4
mozilla/webtools/bugzilla/Bugzilla/Template.pm
View File

@ -890,10 +890,12 @@ sub create {
}, },
# In CSV, quotes are doubled, and any value containing a quote or a # In CSV, quotes are doubled, and any value containing a quote or a
# comma is enclosed in quotes. # comma is enclosed in quotes. If a field starts with an equals
# sign, it is proceed by a space.
csv => sub csv => sub
{ {
my ($var) = @_; my ($var) = @_;
$var = ' ' . $var if substr($var, 0, 1) eq '=';
$var =~ s/\"/\"\"/g; $var =~ s/\"/\"\"/g;
if ($var !~ /^-?(\d+\.)?\d*$/) { if ($var !~ /^-?(\d+\.)?\d*$/) {
$var = "\"$var\""; $var = "\"$var\"";

8
mozilla/webtools/bugzilla/template/en/default/reports/report-table.csv.tmpl
View File

@ -23,11 +23,13 @@
[% END %] [% END %]
[% tbl_field_disp FILTER csv %]: [% tbl_disp FILTER csv %] [% tbl_field_disp FILTER csv %]: [% tbl_disp FILTER csv %]
[% END %] [% END %]
[% IF row_field %] [% IF row_field && col_field %]
[% row_field_disp _ ' / ' _ col_field_disp FILTER csv %]
[% ELSIF row_field %]
[% row_field_disp FILTER csv %] [% row_field_disp FILTER csv %]
[% ELSE %]
[% col_field_disp FILTER csv %]
[% END %] [% END %]
[% " / " IF col_field AND row_field %]
[% col_field_disp FILTER csv %]
[% IF col_field -%] [% IF col_field -%]
[% FOREACH col = col_names -%] [% FOREACH col = col_names -%]
[% colsepchar %] [% colsepchar %]