monzero-gui.git/src/libwalletqt, branch mainMonzero desktop wallet graphical interface.
https://code.monzero.org/monzero-gui.git/atom?h=main2026-06-18T14:29:34ZTransactionHistory: prevent CSV formula injection in writeCSV2026-06-18T14:29:34ZThomasthomas.giudici@proton.me2026-06-18T10:17:18Zurn:sha1:0fbb1716fba3847a7d6f60287d20c1d9f03489cf
writeCSV wrote the transaction note and subaddress label into the CSV
stripping only the quote character. A cell beginning with =, +, - or @
can be interpreted as a formula by spreadsheet software on open, which
CSV quoting does not prevent.
The transaction note can be attacker-controlled: a payment request's
tx_description is stored as the note when the payment is sent, so a
crafted note can run a spreadsheet formula when the user later exports
and opens their history, potentially enabling data exfiltration or
command execution.
Prefix affected fields with a single quote so they are treated as text;
fields beginning with whitespace or a control character are prefixed too.
Co-authored-by: selsta <selsta@sent.at>
Merge pull request #46022026-06-17T18:42:20Ztobtohttob@featherwallet.org2026-06-17T18:42:20Zurn:sha1:a003cb75b6416488d0a448198e6de03211ae1a67
1627661 libwalletqt: capture background sync password by value (selsta)
ACKs: plowsof
libwalletqt: start wallet refresh worker lazily2026-06-05T17:34:05Zselstaselsta@sent.at2026-06-05T09:41:51Zurn:sha1:bfce02b5c20adbbe5c8799dded0844618a506946libwalletqt: capture background sync password by value2026-06-03T15:43:49Zselstaselsta@sent.at2026-06-03T15:43:49Zurn:sha1:16276615302f908f0c0f800699b877ba787c136cImplement background sync when locked2025-08-03T17:26:11Zj-bermanjustinberman@protonmail.com2023-11-17T00:38:52Zurn:sha1:5332495c2404ab4b102c98c22419e70143b1dc90Update year in Cypyright2024-01-27T19:12:09Zinson175314629+inson1@users.noreply.github.com2024-01-27T19:12:09Zurn:sha1:8851e71a8beafb5297be46dbb4d6884aa87bcdd5remove output blackballing2023-03-03T13:02:58Ztobtohttob@featherwallet.org2023-03-03T12:57:18Zurn:sha1:bdf14a2520433be97e0eed28ae3601f9807cb09eFix behavior when switching nodes2022-09-22T03:56:55Zj-bermanjustinberman@protonmail.com2022-09-22T03:56:55Zurn:sha1:6f2aafdd6c89743d6ddab0ce74b26e55f20b27ec
- Improved synchronization when switching nodes
- Avoid infinite "Connecting" loop
- Pause refresh loop while switching, don't start until connected
libwalletqt: refresh once on wallet opening2022-08-06T19:58:21Zselstaselsta@sent.at2022-08-06T19:58:21Zurn:sha1:fc261502d15423c611c11bf778a58224bfddac65
Co-authored-by: tobtoht <thotbot@protonmail.com>
libwallet: add scanTransactions function2022-05-28T01:15:18Zselstaselsta@sent.at2022-05-28T00:02:17Zurn:sha1:6e0b5e2be5b8bc3df2c85fbc39b7f36ee588c110