pangolin_mirror/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-10-29 06:59:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
8,805 Commits 21 Branches 99 Tags
372c0396dfb69d935d5b0dbd75f322f99fb25385
Commit Graph
10 Commits
Author SHA1 Message Date
Dhananjay Maurya bae174766b Neutralise formula prefixes in CSV log exports 
generateCSV escaped quotes only when a value happened to contain a comma and never neutralised formula prefixes, so every CSV log export could emit attacker controlled cells that execute when an admin opens the file. actor is a virtual API key name validated as nothing more than a non-empty string, and path, host, originalRequestURL, metadata and the AI session bodies come straight from the client request.

Each value now goes through a single encoder that collapses CR, LF and CRLF to a literal \n so a record can never be split across rows, prefixes a leading apostrophe when the first character would make a spreadsheet evaluate the cell as a formula, and quotes whenever the field contains a comma or a quote instead of only when it contains a comma. Headers use the same encoder so a column name cannot desynchronise the rows from the header row.

The five CSV export endpoints also declare charset=utf-8, matching the content type already used by the log streaming destination.

Fixes #3864
 2026-10-08 14:43:43 +05:30
Owen c85a7f6ac5 Migrate unkown openapi response from string to {} 2026-06-09 15:35:08 -07:00
copilot-swe-agent[bot]andoschwartz10612 a0a093ed0b Document all registerPath responses and normalize OpenAPI parser schemas 
Agent-Logs-Url: https://github.com/fosrl/pangolin/sessions/73990123-9c27-444b-bc6e-77e890a0d57c

Co-authored-by: oschwartz10612 <4999704+oschwartz10612@users.noreply.github.com>
 2026-05-17 06:43:10 +00:00
Owen aa95e5bb86 Update year 2026-04-15 14:41:13 -07:00
miloschwartz 4cab693cfc openapi and swagger ui improvements and cleanup 2026-03-03 14:54:17 -08:00
Fred KISSIE f9c0e0ec3d 💬 updated text 2025-12-10 03:56:08 +01:00
Fred KISSIE df4b9de334 🚧 wip: export limits 2025-12-10 03:24:32 +01:00
Fred KISSIE d490cab48c Merge dev into fix/log-analytics-adjustments 2025-12-10 03:19:14 +01:00
Owen 264bf46798 Filtering working on both access and request 2025-10-23 14:34:56 -07:00
Owen 0211f75cb6 Access logs working 2025-10-22 17:42:27 -07:00