security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

2026-07-12 17:33:58 +08:00
parent c0ec6660ef
commit c80091c8d6
7 changed files with 49 additions and 6 deletions
@@ -1,6 +1,8 @@
 export function escapeCsv(value: string | number | null | undefined): string {
  if (value === null || value === undefined) return ''
-  const str = String(value)
+  let str = String(value)
+  // Prevent CSV formula injection (Excel/LibreOffice execute cells starting with these chars)
+  if (/^[=+\-@\t\r]/.test(str)) str = "'" + str
  if (str.includes(',') || str.includes('"') || str.includes('\n')) {
    return `"${str.replace(/"/g, '""')}"`
  }