version 1.14.1 (#2532)

* no back links in modal pages
* remove unused service links to bountysource and gitter
* add validation for budget and time-budget fields
* display time budget if set
* remove console log
* sanitize DDE payloads
* do not show status and name in version string

src/Utils/StringHelper.php

@@ -11,6 +11,9 @@ namespace App\Utils;
 
 final class StringHelper
 {
+    // @see https://github.com/payloadbox/csv-injection-payloads
+    private const DDE_PAYLOADS = ['=', '-', '@', '+', "\t", "\n", "\r", "\r\n"];
+
     public static function ensureMaxLength(?string $string, int $length): ?string
     {
         if (null === $string) {
@@ -23,4 +26,22 @@ final class StringHelper
 
         return $string;
     }
+
+    public static function sanitizeDDE(string $text): string
+    {
+        $sanitize = false;
+
+        if (\in_array($text[0], self::DDE_PAYLOADS)) {
+            $sanitize = true;
+        } elseif (stripos($text, 'DDE') !== false) {
+            $sanitize = true;
+        }
+
+        if ($sanitize) {
+            // trying to prevent fucking Microsoft "feature" DDE
+            $text = "' " . $text;
+        }
+
+        return $text;
+    }
 }