Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent csv/xls injection (#429) #430

Closed
wants to merge 3 commits into from
Closed

Prevent csv/xls injection (#429) #430

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ada9b89
Prevent csv/xls injection (#429)
Jan 6, 2021
831712a
Removed unnecessary variables (#429)
Jan 6, 2021
f82a18e
Make injection protection optional (#429)
Jan 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/Writer/CsvWriter.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,13 @@ public function write(array $data): void
EXCEPTION);
}

// prevent csv injection
$patterns = ['/^=/', '/^\+/', '/^-/', '/^@/'];
$replace = ['!=', '!+', '!-', '!@'];
foreach ($data as $key => $value) {
$data[$key] = preg_replace($patterns, $replace, $value);
}
timwentzell marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As pointed out by @VincentLanglet , that can break a lot of things. Here, we don't know that this is going to go through Excel, I don't think this writer should be changed.


$result = @fputcsv($this->file, $data, $this->delimiter, $this->enclosure, $this->escape);

if (!$result) {
Expand Down
5 changes: 4 additions & 1 deletion src/Writer/XlsWriter.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,11 @@ public function write(array $data): void
$this->init($data);

fwrite($this->file, '<tr>');
// prevent xls injection
$patterns = ['/^=/', '/^\+/', '/^-/', '/^@/'];
$replace = ['!=', '!+', '!-', '!@'];
foreach ($data as $value) {
fwrite($this->file, sprintf('<td>%s</td>', $value));
fwrite($this->file, sprintf('<td>%s</td>', preg_replace($patterns, $replace, $value)));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please apply the same here.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes good point - no need of those variables being set.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case people actually rely on the values not being escaped, should their be an option to disable the escaping?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I was just thinking maybe this could be a configurable option. I had a client run a pen test on an application using Sonata Admin with the Exporter bundle and they identified this vulnerability - and I had to fix it or else they weren't going to use our application. I didn't like the idea of manipulating the cell data but it was the only option I could find to "plug the hole".

If this isn't useful for the community that's totally fine, for now I've just made my own CsvWriter and XlsWriter classes and use those in place of the ones in this bundle, but that makes me have to closely monitor the changes in those classes when I want to update this bundle - which is no fun at all...

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case people actually rely on the values not being escaped, should their be an option to disable the escaping?

I have now made it optional, defaulting to not used (false) so any existing applications using this bundle will not experience any change unless they explicitly add the safe_cells configuration parameter and set it to true for one or both writers.

}
fwrite($this->file, '</tr>');

Expand Down