Maximilian Stubhan
f96773da0f
Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.
Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.
10 lines
512 B
TypeScript
10 lines
512 B
TypeScript
// PostgREST's .or() filter syntax treats "," "(" and ")" as structural
|
|
// delimiters between conditions. A raw user-supplied search term containing
|
|
// them (e.g. from a search box or ?q= param) can break out of the intended
|
|
// column conditions and append arbitrary extra filters to the query. Strip
|
|
// them before interpolating — harmless for real name/title searches, which
|
|
// never legitimately contain them.
|
|
export function sanitizeIlikeTerm(term: string): string {
|
|
return term.replace(/[,()]/g, "");
|
|
}
|