47d0374386
🟠 HIGH (security): ExportButtons.escapeCsvCell now prefixes cells starting with =/+/-/@/tab/CR with a leading apostrophe (OWASP CWE-1236). Prevents Excel/Calc/Sheets from evaluating attacker-controllable strings (egrn.address, cad_num) as formulas (=cmd|... / =HYPERLINK / DDE). 🟡 MEDIUM: buildFallbackEgrn now returns area_m2: NaN instead of 0; KPI 'Площадь' and EgrnPropertyTable 'Площадь' row both gate on Number.isFinite + >0, rendering '—' consistently when EGRN absent (previously asymmetric: KPI '—' / table '0 м²'). 🟢 LOW: scoreVerdict collapsed dead branch (both >=80 and >=65 returned same ПОДХОДИТ label). MiniMap toSiteMapData narrows source via explicit ternary instead of unchecked 'as' cast. |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| .dockerignore | ||
| .env.example | ||
| .eslintrc.json | ||
| Dockerfile | ||
| next-env.d.ts | ||
| next.config.ts | ||
| package-lock.json | ||
| package.json | ||
| sentry.client.config.ts | ||
| sentry.edge.config.ts | ||
| sentry.server.config.ts | ||
| tsconfig.json | ||