monzero-gui.git/src/libwalletqt/TransactionHistory.cpp, branch main

TransactionHistory: prevent CSV formula injection in writeCSV

2026-06-18T14:29:34Z

writeCSV wrote the transaction note and subaddress label into the CSV stripping only the quote character. A cell beginning with =, +, - or @ can be interpreted as a formula by spreadsheet software on open, which CSV quoting does not prevent. The transaction note can be attacker-controlled: a payment request's tx_description is stored as the note when the payment is sent, so a crafted note can run a spreadsheet formula when the user later exports and opens their history, potentially enabling data exfiltration or command execution. Prefix affected fields with a single quote so they are treated as text; fields beginning with whitespace or a control character are prefixed too. Co-authored-by: selsta

Update year in Cypyright

2024-01-27T19:12:09Z

Merge pull request #3572

2021-09-05T16:58:39Z

544cff7 TransactionHistory: add description to csv export (selsta) 57c2052 TransactionInfo: add isCoinbase and description (selsta)

TransactionHistory: add description to csv export

2021-08-31T03:50:54Z

TransactionHistory: use displayAmount for amount

2021-06-18T00:08:37Z

src: fix qt 5.15 warnings

2020-04-28T17:00:53Z

TransactionHistory: fix use-after-free bugs

2019-12-16T13:31:31Z

TransactionHistory: guard tx info list against concurrent access

2019-12-04T10:33:54Z

Add copyright headers

2019-05-01T20:53:04Z

CSV export functionality for transaction history

2019-01-21T03:50:43Z