RockteMQ-AI commented on issue #1461: URL: https://github.com/apache/rocketmq-dashboard/issues/1461#issuecomment-5237542465
**Issue Evaluation** Category: `bug` | Status: **Confirmed** The DLQ CSV export formula injection via leading line-feed (`\n=HYPERLINK(...)`) is a valid security concern. CSV quoting alone does not neutralize spreadsheet formula interpretation — spreadsheet apps strip leading control whitespace before evaluating formulas. **Root Cause:** The formula-prefix guard checks `=`, `+`, `-`, `@`, tab, CR but omits `\n` (line feed). **Impact:** CSV formula injection vulnerability in DLQ message exports — potential phishing vector via crafted DLQ messages. **Severity:** Medium — security concern, requires crafted DLQ message content. A fix PR is available: #1462 (`agent/dlq-csv-newline-guard`). --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
