spree_core 5.2.7 → 5.2.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 729147132263dcf0c7d05f60e13fa6aeaa24a38625a5ef2cf9c749f1791c238c
-  data.tar.gz: 9493863773080c567924e9d8615b9741c4412f73857f05070a865ac53ff294a6
+  metadata.gz: 102bf5c31c0361b79a2f8b33d3e726db61fa8b92a6b7e8fe4af9e89e92d2559d
+  data.tar.gz: 2c8309529ba90261d29114ec7eb7a4243e52c23d4965d3496af845c51db43dc8
 SHA512:
-  metadata.gz: a7394275107208ee5f2a30b065cf9a8e131355d440b74dcc7fd95fe9d2114462f578a3c9722121d826bfa2458f4543b7e8933d477abcca4e05404175d293ea13
-  data.tar.gz: f1168bd875c177d05a28d515488d8f0dcb0abe88749279d8c07837bf9d7e53526887e85ccfca9b1dc1322122ee95c6b43ad3955297a207e9d784a606bce0b723
+  metadata.gz: 97c1d37aaf91550e90b2839d2d645aaa240bff7de236e4cce11782e48f14738545af6181a2ade97dc3bcec209a3bb236f473968fa4df34194accc9234e73e65a
+  data.tar.gz: ba7fa245c81056c279e3cff639d5f3c1895b06aef930eade1efdd783ee8954e80dbd2043f2ed84b76fa93c5618a5f4eb95eec4afbd21fa9fd052717734a2a4f0

data/app/models/spree/export.rb

@@ -72,10 +72,10 @@ module Spree
           batch.each do |record|
             if multi_line_csv?
               record.to_csv(store).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             else
-              csv << record.to_csv(store)
+              csv << Spree::CSV::FormulaSanitizer.row(record.to_csv(store))
             end
           end
         end

data/app/presenters/spree/csv/formula_sanitizer.rb

@@ -0,0 +1,28 @@
+module Spree
+  module CSV
+    # Neutralizes CSV formula injection (CWE-1236 / OWASP "CSV Injection")
+    # by prefixing cells that would otherwise be evaluated as a formula
+    # when the exported file is opened in Excel, Google Sheets, LibreOffice,
+    # or Numbers.
+    #
+    # The leading apostrophe is the OWASP-recommended marker — spreadsheets
+    # render the cell as plain text without displaying the apostrophe.
+    module FormulaSanitizer
+      TRIGGERS = ["=", "+", "-", "@", "\t", "\r", "\n"].freeze
+
+      module_function
+
+      def cell(value)
+        return value unless value.is_a?(String)
+        return value if value.empty?
+        return value unless TRIGGERS.include?(value[0])
+
+        "'#{value}"
+      end
+
+      def row(values)
+        values.map { |v| cell(v) }
+      end
+    end
+  end
+end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.2.7'.freeze
+  VERSION = '5.2.8'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.2.7
+  version: 5.2.8
 platform: ruby
 authors:
 - Sean Schofield
@@ -1223,6 +1223,7 @@ files:
 - app/models/spree/zone_member.rb
 - app/paginators/spree/shared/paginate.rb
 - app/presenters/spree/csv/customer_presenter.rb
+- app/presenters/spree/csv/formula_sanitizer.rb
 - app/presenters/spree/csv/gift_card_presenter.rb
 - app/presenters/spree/csv/metafields_helper.rb
 - app/presenters/spree/csv/newsletter_subscriber_presenter.rb
@@ -1704,9 +1705,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.7
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.2.8
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.2.7
+  source_code_uri: https://github.com/spree/spree/tree/v5.2.8
 rdoc_options: []
 require_paths:
 - lib