zentralopensource / zentral / 27813804054

89%

push

github

Sanitize XLSX worksheet names on export (#1519)

* Sanitize XLSX worksheet names on export

xlsxwriter rejects worksheet names that exceed 31 chars, contain any of
[]:*?/\, start/end with an apostrophe, or collide case-insensitively. The
inventory export named aggregation sheets after user-controlled data (tag,
app, bundle and compliance check names) with only length truncation applied,
so a value like a tag named "QA/Prod" raised InvalidWorksheetName and crashed
the export task.

Add zentral.utils.xlsx.add_worksheet(workbook, name), which sanitizes the
name and dedupes it against the workbook's existing sheets before delegating
to Workbook.add_worksheet, and route every add_worksheet call site through it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Pin _check_sheetname link to a commit permalink

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Test the osquery distributed query results export task

The export task body (CSV / NDJSON / XLSX) was previously never executed by
the test suite — only the API view's auth and enqueue paths were covered. Add
task-level tests so the XLSX worksheet sanitization is exercised end to end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

34 of 34 new or added lines in 6 files covered. (100.0%)

47222 of 53344 relevant lines covered (88.52%)

0.89 hits per line