Repository navigation
Conversation
Bumps [thruster](https://github.com/basecamp/thruster) from 0.1.25 to 0.1.26. - [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md) - [Commits](basecamp/thruster@v0.1.25...v0.1.26) --- updated-dependencies: - dependency-name: thruster dependency-version: 0.1.26 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 4.47.0 to 4.48.0. - [Release notes](https://github.com/SeleniumHQ/selenium/releases) - [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES) - [Commits](SeleniumHQ/selenium@selenium-4.47.0...selenium-4.48.0) --- updated-dependencies: - dependency-name: selenium-webdriver dependency-version: 4.48.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [sentry-ruby](https://github.com/getsentry/sentry-ruby) from 6.7.0 to 7.0.0. - [Release notes](https://github.com/getsentry/sentry-ruby/releases) - [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-ruby@6.7.0...7.0.0) --- updated-dependencies: - dependency-name: sentry-ruby dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [sentry-rails](https://github.com/getsentry/sentry-ruby) from 6.7.0 to 7.0.0. - [Release notes](https://github.com/getsentry/sentry-ruby/releases) - [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-ruby@6.7.0...7.0.0) --- updated-dependencies: - dependency-name: sentry-rails dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [image_processing](https://github.com/janko/image_processing) from 2.0.3 to 2.1.0. - [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md) - [Commits](janko/image_processing@v2.0.3...v2.1.0) --- updated-dependencies: - dependency-name: image_processing dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [bootsnap](https://github.com/rails/bootsnap) from 1.25.0 to 1.26.0. - [Release notes](https://github.com/rails/bootsnap/releases) - [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md) - [Commits](rails/bootsnap@v1.25.0...v1.26.0) --- updated-dependencies: - dependency-name: bootsnap dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [simplecov](https://github.com/simplecov-ruby/simplecov) from 1.1.1 to 1.2.0. - [Release notes](https://github.com/simplecov-ruby/simplecov/releases) - [Changelog](https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md) - [Commits](simplecov-ruby/simplecov@v1.1.1...v1.2.0) --- updated-dependencies: - dependency-name: simplecov dependency-version: 1.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Prove export paths call to_plain_text before csv_safe_cell so HTML wrappers cannot hide leading spreadsheet formula characters. Co-authored-by: rsmoke <rsmoke@umich.edu>
Extend csv_safe_cell coverage to faculty names, student emails, office numbers, and calendar event titles/descriptions so admin downloads cannot execute spreadsheet formulas from user-controlled fields. Co-authored-by: rsmoke <rsmoke@umich.edu>
Bump thruster from 0.1.25 to 0.1.26
…river-4.48.0 Bump selenium-webdriver from 4.47.0 to 4.48.0
…ing-2.1.0 Bump image_processing from 2.0.3 to 2.1.0
Bump bootsnap from 1.25.0 to 1.26.0
Bump simplecov from 1.1.1 to 1.2.0
Add ActionText CSV formula neutralization regression specs
Neutralize CSV formula injection in appointment and calendar exports
sentry-rails 7.0.0 logs ActionController paths by default, which would expose live reset tokens in /passwords/:token. Co-authored-by: Cursor <cursoragent@cursor.com>
….0.0 Bump sentry-ruby from 6.7.0 to 7.0.0
sentry-rails 7 logs ActionController paths by default, and those paths include /passwords/:token. Filter logs, error events, and breadcrumbs so reset tokens are not sent to Sentry. Co-authored-by: Cursor <cursoragent@cursor.com>
…7.0.0 Bump sentry-rails from 6.7.0 to 7.0.0
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request focuses on improving the security and correctness of CSV exports and Sentry error logging. The most significant changes are the introduction of a filter to redact sensitive tokens from Sentry logs and events, and enhancements to CSV export logic and tests to prevent spreadsheet formula injection, including handling of ActionText content.
Sentry Sensitive Data Redaction:
SentrySensitivePathFilterinlib/sentry_sensitive_path_filter.rbto redact password reset tokens from URLs and paths in Sentry logs, events, and breadcrumbs. This prevents sensitive tokens from leaking into error logs and dashboards.config/initializers/sentry.rb) to use the new filter forbefore_send_log,before_send,before_send_transaction, andbefore_breadcrumbhooks, ensuring all relevant Sentry data is sanitized. [1] [2] [3] [4]spec/lib/sentry_sensitive_path_filter_spec.rb, covering log events, breadcrumbs, and error events.CSV Export Security and Correctness:
CsvExportServiceto usecsv_safe_cellfor faculty names, office numbers, student emails, event titles, and descriptions. This neutralizes spreadsheet formulas and prevents CSV injection, including handling ActionText content by converting it to plain text before neutralization. [1] [2] [3] [4] [5]spec/services/csv_export_service_spec.rbto verify that all potentially dangerous values are properly neutralized in CSV exports, including edge cases with ActionText and various formula prefixes. [1] [2] [3] [4] [5] [6]Dependency Update:
image_processinggem version from~> 2.0to~> 2.1in theGemfilefor compatibility and maintenance.