Hartmut/Nexus
1
0
Fork 0
Code Issues 11 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(import): harden untrusted spreadsheet boundaries

Browse Source
This commit is contained in:
Hartmut Nörenberg
2026-03-30 08:02:52 +02:00
parent fac8c1c3a5
commit f6daf21983
13 changed files with 561 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/src/components/estimates/EstimateWizard.tsx
+2 -2
View File
@@ -269,7 +269,7 @@ export function EstimateWizard({ onClose }: { onClose: () => void }) {
event.target.value = "";
if (!isSpreadsheetFile(file)) {
setScopeImportWarnings(["Unsupported file type. Please upload .xlsx, .xls, or .csv."]);
setScopeImportWarnings(["Unsupported file type. Please upload .xlsx or .csv."]);
return;
}
@@ -586,7 +586,7 @@ export function EstimateWizard({ onClose }: { onClose: () => void }) {
<div className="flex gap-2">
<label className="cursor-pointer rounded-xl border border-gray-200 px-3 py-2 text-sm text-gray-600 transition hover:border-gray-300 hover:text-gray-900">
Import XLSX
<input type="file" accept=".xlsx,.xls,.csv" onChange={handleScopeImport} className="hidden" />
<input type="file" accept=".xlsx,.csv" onChange={handleScopeImport} className="hidden" />
</label>
<button type="button" onClick={() => setScopeItems((current) => [...current, makeScope(current.length + 1)])} className="rounded-xl border border-gray-200 px-3 py-2 text-sm text-gray-600 transition hover:border-gray-300 hover:text-gray-900">
Add scope row
apps/web/src/components/estimates/editors/ScopeItemEditor.tsx
+2 -2
View File
@@ -67,8 +67,8 @@ export function ScopeItemEditor({
<div className="space-y-4">
<div className="flex flex-wrap items-center gap-3">
<label className="cursor-pointer rounded-2xl border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 transition hover:bg-gray-50">
Import scope from XLSX
<input type="file" accept=".xlsx,.xls,.csv" className="hidden" onChange={(event) => void handleScopeImport(event)} />
Import scope from spreadsheet
<input type="file" accept=".xlsx,.csv" className="hidden" onChange={(event) => void handleScopeImport(event)} />
</label>
{scopeImportWarnings.length > 0 && (
<div className="text-xs text-amber-700">