OpenSourceArk/Ghost
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
de668e7950
Ghost/ghost
History
Daniel Lockyer de668e7950 🔒 Added escaping to member export CSV fields 
fix https://linear.app/tryghost/issue/ENG-805/
refs https://owasp.org/www-community/attacks/CSV_Injection

- it's possible for certain fields in a member CSV export to be executed
  by software that opens the CSVs
- we can protect against this for the user by escaping any forumulae in
  the CSV fields
- papaparse provides this option natively, so it's just a case of
  providing the field to the unparse method
- credits to Harvey Spec (phulelouch) for reporting
2024-04-03 10:21:02 +02:00
..
adapter-cache-memory-ttl Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
adapter-cache-redis Implemented Refresh-Ahead caching for Redis 2024-01-18 20:16:36 +07:00
adapter-manager Aligned dependencies with resolution values 2023-10-13 08:37:36 +02:00
admin Fixed setup/done screen showing 500 when not authenticated (#19973) 2024-04-02 16:43:44 +00:00
announcement-bar-settings Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
api-framework Cached api controller pipelines (#19880) 2024-03-19 00:29:41 +07:00
api-version-compatibility-service Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
audience-feedback Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
bookshelf-repository Removed usage of yg when using NQL (#19287) 2024-01-15 14:40:01 +00:00
bootstrap-socket Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
collections Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
constants Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
core Update sentry-javascript monorepo to v7.109.0 2024-04-01 14:10:07 +02:00
custom-theme-settings-service Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
data-generator Added support for clearing all data with data generator (#19901) 2024-03-25 14:44:28 +01:00
domain-events Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
donations Update dependency typescript to v5.4.3 2024-03-21 09:28:10 +01:00
dynamic-routing-events Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
email-addresses Update dependency typescript to v5.4.3 2024-03-21 09:28:10 +01:00
email-analytics-provider-mailgun Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
email-analytics-service Update TryGhost packages 2023-10-31 20:54:17 +01:00
email-content-generator Update dependency fs-extra to v11.2.0 2023-11-28 11:54:44 +01:00
email-events Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
email-service Removed Powered by Ghost clicks in publisher analytics (#19926) 2024-03-26 17:51:23 +01:00
email-suppression-list Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
express-dynamic-redirects Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
external-media-inliner Add Lexical support to the external-media-inliner (#19149) 2023-11-29 17:56:03 +00:00
extract-api-key Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
ghost Update nest monorepo to v10.3.7 2024-03-28 10:12:04 +01:00
html-to-plaintext Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
i18n Made changes in Turkish local for Comments, Ghost and Portal (#19919) 2024-03-27 08:21:16 -04:00
importer-handler-content-files Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
importer-revue 🐛 Fixed rare rendering issue of lists appearing as headings (#19511) 2024-01-22 09:43:05 +01:00
in-memory-repository Added tests to AdminX framework package (#19022) 2023-11-20 11:00:51 +00:00
job-manager Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
link-redirects Update Types packages 2023-11-08 12:13:12 +01:00
link-replacer 🐛 Fixed unexpected conversion of single-quoted attributes in HTML cards (#19727) 2024-03-06 09:11:49 +00:00
link-tracking Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
magic-link Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
mail-events Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
mailgun-client Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
member-attribution 🐛 Fixed unexpected conversion of single-quoted attributes in HTML cards (#19727) 2024-03-06 09:11:49 +00:00
member-events Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
members-api Update dependency express to v4.19.2 [SECURITY] 2024-03-27 11:18:44 +01:00
members-csv 🔒 Added escaping to member export CSV fields 2024-04-03 10:21:02 +02:00
members-events-service Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
members-importer Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
members-ssr Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
mentions-email-report Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
milestones Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
minifier Update dependency terser to v5.30.2 2024-04-02 13:08:00 +00:00
model-to-domain-event-interceptor Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
mw-api-version-mismatch Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
mw-cache-control Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
mw-error-handler Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
mw-session-from-token Update dependency express to v4.19.2 [SECURITY] 2024-03-27 11:18:44 +01:00
mw-update-user-last-seen Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
mw-version-match Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
mw-vhost Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
nql-filter-expansions Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
oembed-service Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
offers Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
package-json Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
payments Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
post-events Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
post-revisions Added tests to AdminX framework package (#19022) 2023-11-20 11:00:51 +00:00
posts-service Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
recommendations 🐛 Fixed adding recommendations with long excerpts (#19949) 2024-03-28 17:02:37 +01:00
referrers Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
security Update TryGhost packages 2023-10-31 20:54:17 +01:00
session-service Update dependency express to v4.19.2 [SECURITY] 2024-03-27 11:18:44 +01:00
settings-path-manager Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
slack-notifications Added ability to pass minThreshold for Milestone Slack notifications 2024-03-14 12:06:43 -04:00
staff-service Added email address alignment protections (#19094) 2023-11-23 10:25:30 +01:00
stats-service Update Types packages 2024-01-15 21:04:04 +01:00
stripe Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
tiers 🐛 Fixed Tiers API erroring when invalid filter passed (#19845) 2024-03-13 00:25:42 +07:00
update-check-service Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
verification-trigger Updated @tryghost/errors dependency 2024-03-11 17:33:51 +01:00
version-notifications-data-service Configured all unit tests to use dot reporter 2023-10-05 12:24:24 +02:00
webmentions Added queueing middleware to handle high request volume (#19887) 2024-03-21 09:25:07 -05:00
tsconfig.json