scottk/chatwoot
1
0
Fork 0
mirror of https://github.com/lingble/chatwoot.git synced 2025-10-30 18:47:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Switch to csv-safe gem to avoid csv injection (#6444)

Browse Source
This commit is contained in:
Sojan Jose
2023-02-14 03:08:36 +05:30
committed by GitHub
parent ff9cadc9a0
commit f0fbaacaf7
6 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Gemfile
View File

@@ -39,6 +39,8 @@ gem 'rack-attack'
gem 'down', '~> 5.0' gem 'down', '~> 5.0'
# authentication type to fetch and send mail over oauth2.0 # authentication type to fetch and send mail over oauth2.0
gem 'gmail_xoauth' gem 'gmail_xoauth'
# Prevent CSV injection
gem 'csv-safe'
##-- for active storage --## ##-- for active storage --##
gem 'aws-sdk-s3', require: false gem 'aws-sdk-s3', require: false

2
Gemfile.lock
View File

@@ -141,6 +141,7 @@ GEM
crack (0.4.5) crack (0.4.5)
rexml rexml
crass (1.0.6) crass (1.0.6)
csv-safe (3.1.1)
cypress-on-rails (1.13.1) cypress-on-rails (1.13.1)
rack rack
database_cleaner (2.0.1) database_cleaner (2.0.1)
@@ -752,6 +753,7 @@ DEPENDENCIES
byebug byebug
climate_control climate_control
commonmarker commonmarker
csv-safe
cypress-on-rails (~> 1.13, >= 1.13.1) cypress-on-rails (~> 1.13, >= 1.13.1)
database_cleaner database_cleaner
ddtrace ddtrace

6
app/views/api/v2/accounts/reports/agents.csv.erb
View File

@@ -5,8 +5,8 @@
I18n.t('reports.agent_csv.avg_resolution_time') I18n.t('reports.agent_csv.avg_resolution_time')
] ]
%> %>
<%= CSV.generate_line headers -%> <%= CSVSafe.generate_line headers -%>
<% @report_data.each do |row| %> <% @report_data.each do |row| %>
<%= CSV.generate_line row -%> <%= CSVSafe.generate_line row -%>
<% end %> <% end %>
<%= CSV.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %> <%= CSVSafe.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %>

6
app/views/api/v2/accounts/reports/inboxes.csv.erb
View File

@@ -6,8 +6,8 @@
I18n.t('reports.inbox_csv.avg_resolution_time') I18n.t('reports.inbox_csv.avg_resolution_time')
] ]
%> %>
<%= CSV.generate_line headers -%> <%= CSVSafe.generate_line headers -%>
<% @report_data.each do |row| %> <% @report_data.each do |row| %>
<%= CSV.generate_line row -%> <%= CSVSafe.generate_line row -%>
<% end %> <% end %>
<%= CSV.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %> <%= CSVSafe.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %>

6
app/views/api/v2/accounts/reports/labels.csv.erb
View File

@@ -5,8 +5,8 @@
I18n.t('reports.label_csv.avg_resolution_time') I18n.t('reports.label_csv.avg_resolution_time')
] ]
%> %>
<%= CSV.generate_line headers -%> <%= CSVSafe.generate_line headers -%>
<% @report_data.each do |row| %> <% @report_data.each do |row| %>
<%= CSV.generate_line row -%> <%= CSVSafe.generate_line row -%>
<% end %> <% end %>
<%= CSV.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %> <%= CSVSafe.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %>

6
app/views/api/v2/accounts/reports/teams.csv.erb
View File

@@ -5,8 +5,8 @@
I18n.t('reports.team_csv.avg_resolution_time') I18n.t('reports.team_csv.avg_resolution_time')
] ]
%> %>
<%= CSV.generate_line headers -%> <%= CSVSafe.generate_line headers -%>
<% @report_data.each do |row| %> <% @report_data.each do |row| %>
<%= CSV.generate_line row -%> <%= CSVSafe.generate_line row -%>
<% end %> <% end %>
<%= CSV.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %> <%= CSVSafe.generate_line [I18n.t('reports.period', since: Date.strptime(params[:since], '%s'), until: Date.strptime(params[:until], '%s'))] %>