fix(backend): Excel formula-injection (#1244) + chat read off event loop (#1245) #1307

Merged

bot-backend merged 1 commit from fix/excel-injection-chat-threadpool-1244-1245 into main

2026-06-13 13:19:44 +00:00

Author	SHA1	Message	Date
Light1YT	3cf9fad683	fix(backend): экранировать Excel formula-injection (#1244 ) + увести chat-чтение с event loop (#1245 ) Some checks failed CI / changes (push) Successful in 6s Details CI / frontend-tests (push) Has been skipped Details CI / changes (pull_request) Successful in 7s Details CI / frontend-tests (pull_request) Has been skipped Details CI / backend-tests (push) Successful in 6m38s Details CI / backend-tests (pull_request) Successful in 6m37s Details Deploy / build-backend (push) Blocked by required conditions Details Deploy / build-worker (push) Blocked by required conditions Details Deploy / build-frontend (push) Blocked by required conditions Details Deploy / deploy (push) Blocked by required conditions Details Deploy / changes (push) Has been cancelled Details #1244 (security): внешние/скрейпинг-строки (comm_name из DOM.РФ, headline/usp_text) с ведущим = + - @ \t \r писались как есть → openpyxl сохранял как формулы (data_type='f'), исполнялись при открытии в Excel/LibreOffice. _sanitize_formula префиксует такие строки апострофом (OWASP CSV-injection escape); числа/даты/bool не трогаются. _write_kv labels тоже санитизируются. Подтверждено на openpyxl 3.1.5. #1245 (concurrency): async ask() вызывал sync get_report_for_chat() (sync SQLAlchemy тянет крупный JSONB §22-отчёт) напрямую — блокировал event loop, в отличие от LLM-ветки (run_in_threadpool). Обёрнуто в run_in_threadpool. Closes #1244 Closes #1245	2026-06-13 18:10:21 +05:00

Author

SHA1

Message

Date

Light1YT

3cf9fad683

fix(backend): экранировать Excel formula-injection (#1244 ) + увести chat-чтение с event loop (#1245 )

CI / changes (push) Successful in 6s

Details

CI / frontend-tests (push) Has been skipped

Details

CI / changes (pull_request) Successful in 7s

Details

CI / frontend-tests (pull_request) Has been skipped

Details

CI / backend-tests (push) Successful in 6m38s

Details

CI / backend-tests (pull_request) Successful in 6m37s

Details

Deploy / build-backend (push) Blocked by required conditions

Details

Deploy / build-worker (push) Blocked by required conditions

Details

Deploy / build-frontend (push) Blocked by required conditions

Details

Deploy / deploy (push) Blocked by required conditions

Details

Deploy / changes (push) Has been cancelled

Details

#1244 (security): внешние/скрейпинг-строки (comm_name из DOM.РФ, headline/usp_text)
с ведущим = + - @ \t \r писались как есть → openpyxl сохранял как формулы
(data_type='f'), исполнялись при открытии в Excel/LibreOffice. _sanitize_formula
префиксует такие строки апострофом (OWASP CSV-injection escape); числа/даты/bool
не трогаются. _write_kv labels тоже санитизируются. Подтверждено на openpyxl 3.1.5.

#1245 (concurrency): async ask() вызывал sync get_report_for_chat() (sync SQLAlchemy
тянет крупный JSONB §22-отчёт) напрямую — блокировал event loop, в отличие от
LLM-ветки (run_in_threadpool). Обёрнуто в run_in_threadpool.

Closes #1244
Closes #1245

2026-06-13 18:10:21 +05:00