spree_core 5.3.5 → 5.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ed5afbde4c027a14e708b2f10a4585eab43df462da64c93d409336561bd3e45
-  data.tar.gz: 7f10df74f02a7770d794793e396486adefcc2349c6e2f0232ed5771b6dec83b2
+  metadata.gz: 9cc8a20703830f22c34bba6cb907ec7895afde999df0550eca4171adc291ffc3
+  data.tar.gz: 5e869ff3a246388179bf7e4cc59de7d56e30abae11a19a06f28fbc6d3009ba77
 SHA512:
-  metadata.gz: 588d726ccf12398f757ded2e252e1fb90de5a11e2c5863aa06bb27a489dd6ba3e9f1993ef68e6370b4476fa8846f59b85a60046d13953723cec4140b516128ea
-  data.tar.gz: 11a5f3e4298506982cecdf1dea096852e500ed157cce75343659252d3573d3e499a3d39ab82553be8e70fb7c8af414e93e016fcb8204b3c6a9cebe03521fcee7
+  metadata.gz: 2b4f2aad8f5699196b1477456ec12006a3cf5c61498e5c4e886730698b1e959881c6a07df170094d22076bf7c21e92a816da7ad2b663f737b8ae8a3c9e2eca19
+  data.tar.gz: 6b836c460679f62490356c7b188965aa0404e82bb7ca7284dea61f3d462903df3e2118b7f76d4026546e1c1e55a78fa83e4f2b51dc488b6284d71629737c0032

data/app/models/spree/export.rb

@@ -82,10 +82,10 @@ module Spree
           batch.each do |record|
             if multi_line_csv?
               record.to_csv(store).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             else
-              csv << record.to_csv(store)
+              csv << Spree::CSV::FormulaSanitizer.row(record.to_csv(store))
             end
           end
         end

data/app/presenters/spree/csv/formula_sanitizer.rb

@@ -0,0 +1,28 @@
+module Spree
+  module CSV
+    # Neutralizes CSV formula injection (CWE-1236 / OWASP "CSV Injection")
+    # by prefixing cells that would otherwise be evaluated as a formula
+    # when the exported file is opened in Excel, Google Sheets, LibreOffice,
+    # or Numbers.
+    #
+    # The leading apostrophe is the OWASP-recommended marker — spreadsheets
+    # render the cell as plain text without displaying the apostrophe.
+    module FormulaSanitizer
+      TRIGGERS = ["=", "+", "-", "@", "\t", "\r", "\n"].freeze
+
+      module_function
+
+      def cell(value)
+        return value unless value.is_a?(String)
+        return value if value.empty?
+        return value unless TRIGGERS.include?(value[0])
+
+        "'#{value}"
+      end
+
+      def row(values)
+        values.map { |v| cell(v) }
+      end
+    end
+  end
+end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.3.5'.freeze
+  VERSION = '5.3.6'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.3.5
+  version: 5.3.6
 platform: ruby
 authors:
 - Sean Schofield
@@ -1190,6 +1190,7 @@ files:
 - app/models/spree/zone_member.rb
 - app/paginators/spree/shared/paginate.rb
 - app/presenters/spree/csv/customer_presenter.rb
+- app/presenters/spree/csv/formula_sanitizer.rb
 - app/presenters/spree/csv/gift_card_presenter.rb
 - app/presenters/spree/csv/metafields_helper.rb
 - app/presenters/spree/csv/newsletter_subscriber_presenter.rb
@@ -1731,9 +1732,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.3.5
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.3.6
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.3.5
+  source_code_uri: https://github.com/spree/spree/tree/v5.3.6
 rdoc_options: []
 require_paths:
 - lib