spree_core 5.2.6 → 5.2.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e0552e5475aa54e072158a70ea648d02d5514550eca293f1c0e0c79554c4216
-  data.tar.gz: afe49cf6d48fa819396d1518e3531435ffc22d038ce1a75aef430082bbc429fb
+  metadata.gz: 102bf5c31c0361b79a2f8b33d3e726db61fa8b92a6b7e8fe4af9e89e92d2559d
+  data.tar.gz: 2c8309529ba90261d29114ec7eb7a4243e52c23d4965d3496af845c51db43dc8
 SHA512:
-  metadata.gz: 46b12717f12408f073b31a2a4f70d8850204bcfd59d32b20a6d891bc0326b7ea0c563c9b876e81156c6ba40f6ba88705553f87bc349598f52e8d761a7ea887a7
-  data.tar.gz: 37e34cbc4020055babe24354344aae7306dde8343267b2bac666fe691881936e5ebf6daeaa982ad4ce1ea4df88eecc77cb168c5321c57c2329b920dba37d05d7
+  metadata.gz: 97c1d37aaf91550e90b2839d2d645aaa240bff7de236e4cce11782e48f14738545af6181a2ade97dc3bcec209a3bb236f473968fa4df34194accc9234e73e65a
+  data.tar.gz: ba7fa245c81056c279e3cff639d5f3c1895b06aef930eade1efdd783ee8954e80dbd2043f2ed84b76fa93c5618a5f4eb95eec4afbd21fa9fd052717734a2a4f0

data/app/models/spree/export.rb

@@ -72,10 +72,10 @@ module Spree
           batch.each do |record|
             if multi_line_csv?
               record.to_csv(store).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             else
-              csv << record.to_csv(store)
+              csv << Spree::CSV::FormulaSanitizer.row(record.to_csv(store))
             end
           end
         end

data/app/models/spree/order/address_book.rb

@@ -14,13 +14,17 @@ module Spree
       end
 
       def bill_address_id=(id)
+        return if bill_address_id == id
+
         address = Spree::Address.find_by(id: id)
-        if address && address.user_id == user_id
+        # rubocop:disable Style/ConditionalAssignment
+        if address && user_id.present? && address.user_id == user_id
           self['bill_address_id'] = address.id
-          bill_address.reload
         else
           self['bill_address_id'] = nil
         end
+        # rubocop:enable Style/ConditionalAssignment
+        reset_bill_address
       end
 
       def bill_address_attributes=(attributes)
@@ -29,13 +33,17 @@ module Spree
       end
 
       def ship_address_id=(id)
+        return if ship_address_id == id
+
         address = Spree::Address.find_by(id: id)
-        if address && address.user_id == user_id
+        # rubocop:disable Style/ConditionalAssignment
+        if address && user_id.present? && address.user_id == user_id
           self['ship_address_id'] = address.id
-          ship_address.reload
         else
           self['ship_address_id'] = nil
         end
+        # rubocop:enable Style/ConditionalAssignment
+        reset_ship_address
       end
 
       def ship_address_attributes=(attributes)

data/app/presenters/spree/csv/formula_sanitizer.rb

@@ -0,0 +1,28 @@
+module Spree
+  module CSV
+    # Neutralizes CSV formula injection (CWE-1236 / OWASP "CSV Injection")
+    # by prefixing cells that would otherwise be evaluated as a formula
+    # when the exported file is opened in Excel, Google Sheets, LibreOffice,
+    # or Numbers.
+    #
+    # The leading apostrophe is the OWASP-recommended marker — spreadsheets
+    # render the cell as plain text without displaying the apostrophe.
+    module FormulaSanitizer
+      TRIGGERS = ["=", "+", "-", "@", "\t", "\r", "\n"].freeze
+
+      module_function
+
+      def cell(value)
+        return value unless value.is_a?(String)
+        return value if value.empty?
+        return value unless TRIGGERS.include?(value[0])
+
+        "'#{value}"
+      end
+
+      def row(values)
+        values.map { |v| cell(v) }
+      end
+    end
+  end
+end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.2.6'.freeze
+  VERSION = '5.2.8'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.2.6
+  version: 5.2.8
 platform: ruby
 authors:
 - Sean Schofield
@@ -1223,6 +1223,7 @@ files:
 - app/models/spree/zone_member.rb
 - app/paginators/spree/shared/paginate.rb
 - app/presenters/spree/csv/customer_presenter.rb
+- app/presenters/spree/csv/formula_sanitizer.rb
 - app/presenters/spree/csv/gift_card_presenter.rb
 - app/presenters/spree/csv/metafields_helper.rb
 - app/presenters/spree/csv/newsletter_subscriber_presenter.rb
@@ -1704,9 +1705,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.6
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.8
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.2.6
+  source_code_uri: https://github.com/spree/spree/tree/v5.2.8
 rdoc_options: []
 require_paths:
 - lib