CSV/Formula injection vulnerability in tax export (api.export.tax.ts)

[shivi14112007-create]

Steps to reproduce

1. Add an inventory item with the name =HYPERLINK("http://evil.example","click") (or any string starting with =, +, -, @).
2. Sell that item (or add an expense with a similarly crafted description).
3. Call GET /api/export/tax?year= and open the downloaded CSV in Excel or Google Sheets.
4. Observe the formula executes/renders as a live hyperlink/formula instead of plain text — this is CSV Formula Injection (CWE-1236), a well-known attack vector for CSV exports containing untrusted data.
5. Separately, add an item/expense with a " in the name (e.g. 6" Jordan sample) — observe the exported CSV row is now malformed because the embedded quote isn't escaped.

Expected behavior

• Any cell value starting with =, +, -, or @ should be neutralized before being written (standard mitigation: prefix with a single quote ' or a leading space, depending on convention) so spreadsheet software treats it as literal text, not a formula.
• Embedded double quotes in any field must be escaped by doubling (" → ""), per RFC 4180, so structure isn't broken by user-entered names/descriptions.

Actual behavior

Both inventoryItem.name/sku and expense.description are interpolated directly into the CSV string with a single wrapping "..." and no sanitization or escaping of their contents.

Proposed solution

• Add a small sanitizeCsvField(value: string): string helper in the same file (or ~/utils) that:
  • Escapes internal " by doubling them.
  • If the first character is =, +, -, @, tab, or CR, prefixes the value with a single quote ' to defuse formula interpretation.
• Apply it to every interpolated user-controlled field in both the Sale and Expense CSV-row builders (inventoryItem.name, inventoryItem.sku, e.description).
• Add a unit/integration test asserting a name like =1+1 is rendered as '=1+1 (or equivalent neutralized form) in the output stream, and a name containing " round-trips correctly.

Alternatives considered

Using a CSV-writing library (e.g. papaparse's unparse) instead of manual string building would handle escaping automatically, but given the file already streams rows incrementally via ReadableStream for memory efficiency with large exports, a small sanitize helper keeps that streaming design intact without pulling in a dependency just for escaping.

Additional Context

• This pattern (manual CSV row building without escaping) may also exist elsewhere if there are other CSV/export routes — happy to grep for and note them separately rather than bundle into this PR.
• I'd like to work on this issue under ECSoC26 — will open a PR only after approval/assignment by @rushikesh-bobade or another maintainer, since it's a security-labeled fix.

[shivi14112007-create]

Hi @rushikesh-bobade , I'd like to work on this issue.
I found it while reviewing api.export.tax.ts for how user data flows into the CSV output — happy to wait for confirmation before starting since it's security-labeled. Once confirmed, please assign it to me. I'll keep the fix scoped to the sanitize helper and its two call sites (inventoryItem.name/sku and expense.description), and add the round-trip test for both the formula-injection case and the embedded-quote case.

[github-actions]

Hi @shivi14112007-create! 👋

Thank you for your interest in contributing to this repository! Please wait until a maintainer officially assigns you to this issue before opening a Pull Request.

While you wait, please consider starring ⭐ this repository to show your support! We review requests regularly and will assign it as soon as possible if it's available. Happy coding! 🚀

[Atharv094]

Hi @rushikesh-bobade, I'd like to work on this
issue if it's still available.

I'm a contributor in ECSoC 2026 with a merged PR
on Pollution-Control-Hub
(Aditya8369/Pollution-Control-Hub#63). I can fix
the CSV formula injection vulnerability in
api.export.tax.ts by sanitizing the output to
escape dangerous characters before export.

Could you assign this to me and add the ECSoC26
label so it counts toward the program?

[Abhay2110s]

hii @rushikesh-bobade can you please assign this issue to me .

[rushikesh-bobade]

Hi @Atharv094 and @Abhay2110s,
Because @shivi14112007-create discovered this vulnerability, filed the detailed report, and proposed the architectural solution, they have priority on this issue. Thank you for your interest!

---

Hi @shivi14112007-create,
Excellent catch! Your analysis of CWE-1236 and RFC 4180 is 100% accurate, and streaming large exports means we definitely want to avoid heavy CSV libraries if a simple helper will do the trick.

I am officially assigning this to you!

Implementation Notes:

1. Please place the sanitizeCsvField helper in a new file at app/utils/csv.server.ts so we can reuse it for future CSV exports (like inventory or sales exports).
2. The logic you proposed is perfect:
   • Replace all " with "".
   • If the string starts with =, +, -, @, \t, or \r, prepend a single quote '.
3. Wrap the final output in double quotes when you interpolate it into the row chunk.
4. Add the unit test as you mentioned to verify the round-trip escaping.

Note: You may notice new PrismaClient() at the top of the file. Another contributor is currently working on a global refactor to implement a Prisma Singleton, so please just leave the Prisma import exactly as it is to avoid merge conflicts!

Looking forward to your PR!