Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escape equals sign in CSV export #4079

Merged
merged 2 commits into from Mar 4, 2024
Merged

Conversation

codyebberson
Copy link
Member

No description provided.

@codyebberson codyebberson requested a review from a team as a code owner March 2, 2024 19:18
Copy link

vercel bot commented Mar 2, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
medplum-provider ✅ Ready (Inspect) Visit Preview 💬 Add feedback Mar 4, 2024 8:13pm
3 Ignored Deployments
Name Status Preview Comments Updated (UTC)
medplum-app ⬜️ Ignored (Inspect) Visit Preview Mar 4, 2024 8:13pm
medplum-storybook ⬜️ Ignored (Inspect) Visit Preview Mar 4, 2024 8:13pm
medplum-www ⬜️ Ignored (Inspect) Visit Preview Mar 4, 2024 8:13pm

Copy link

github-actions bot commented Mar 2, 2024

Messages
📖 @medplum/core: 169.5 kB
📖 @medplum/react: 353.1 kB

Generated by 🚫 dangerJS against 38fcf21

Copy link
Member

@ThatOneBro ThatOneBro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ThatOneBro ThatOneBro added this to the March 31st, 2024 milestone Mar 4, 2024
@ThatOneBro ThatOneBro added the security Security best practices and enhancements label Mar 4, 2024
@codyebberson
Copy link
Member Author

codyebberson commented Mar 4, 2024

TIL: https://owasp.org/www-community/attacks/CSV_Injection

Hm, nice catch, we should probably include all of those special characters, not just =

Equals to (=)
Plus (+)
Minus (-)
At (@)
Tab (0x09)
Carriage return (0x0D)

Copy link

sonarcloud bot commented Mar 4, 2024

@codyebberson codyebberson added this pull request to the merge queue Mar 4, 2024
Merged via the queue into main with commit 8b4b559 Mar 4, 2024
24 checks passed
@codyebberson codyebberson deleted the cody-csv-export-escape-equals branch March 4, 2024 20:45
medplumbot added a commit that referenced this pull request Mar 6, 2024
IF-MATCH header for resource contention (#4088)
ci(autofix.ci): replace `prettier` action w/ `autofix.ci` (#4093)
Added initial key value API (#4041)
Bugfix: Read ClientApplication from Login resource (#4098)
Fixes #4084 - validate reference resource type (#4094)
fix(client): add check for `isInitialized` in `isLoading()` (#4097)
Removing warnings (#4095)
Fix - Added creatable prop to CodingInput in QuestionnaireChoiceSetInput at QuestionnaireFormItem. (#4089)
Implement terminology operations for validation (#4073)
Fixes #2021 - support _type search parameter (#4064)
Fixes #4086 - getExtensionValue all value types (#4087)
Copy update RE EHR (#4081)
Dependency upgrades (#4082)
Escape equals sign in CSV export (#4079)
Fixes #4069 - validate choice-of-type cardinality (#4080)
Remove faulty console.assert (#4070)
Fixes #4054 - update agent docs (#4078)
Add documentation on running docker without aws (#4077)
@medplumbot medplumbot mentioned this pull request Mar 6, 2024
github-merge-queue bot pushed a commit that referenced this pull request Mar 6, 2024
IF-MATCH header for resource contention (#4088)
ci(autofix.ci): replace `prettier` action w/ `autofix.ci` (#4093)
Added initial key value API (#4041)
Bugfix: Read ClientApplication from Login resource (#4098)
Fixes #4084 - validate reference resource type (#4094)
fix(client): add check for `isInitialized` in `isLoading()` (#4097)
Removing warnings (#4095)
Fix - Added creatable prop to CodingInput in QuestionnaireChoiceSetInput at QuestionnaireFormItem. (#4089)
Implement terminology operations for validation (#4073)
Fixes #2021 - support _type search parameter (#4064)
Fixes #4086 - getExtensionValue all value types (#4087)
Copy update RE EHR (#4081)
Dependency upgrades (#4082)
Escape equals sign in CSV export (#4079)
Fixes #4069 - validate choice-of-type cardinality (#4080)
Remove faulty console.assert (#4070)
Fixes #4054 - update agent docs (#4078)
Add documentation on running docker without aws (#4077)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Security best practices and enhancements
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

None yet

2 participants