MantisBT: master-2.28 65c2dd3e

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master-2.28 2026-03-19 14:29 master-2.28 b80bd8bd
Affected Issues  0029130: CVE-2021-43257: CSV Injection with CSV Export Feature
 0036991: Improve protection against CSV injection
Changeset

Always quote tab-prefixed CSV string when escaping

According to OWASP 1, when prefixing a string with tab to avoid CSV
injection, the string should always be quoted.

Improves fix for Issue 0029130.

Fixes 0036991
mod - core/csv_api.php Diff File