Merge pull request #34 from Pr0cella/2.9.2

Pr0cella · web-flow · commit d6c777311a4d · 2026-04-30T20:46:21.000+02:00
# v2.9.2
- Added html comment with project title and source
- Improved CSV formula injection mitigation (see changelog)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 ---
+## [2.9.2] - 2026-04-30
+
+### Added 
+- Small HTML Docstring with project info
+
+### Changed
+- **CSV Formula Injection Mitigation**: Cells starting with formula characters are now prefixed with a tab character (\t) and wrapped in double quotes instead of just the single quote prefix that was used previously
 
 ## [2.9.1] - 2026-02-28
 
diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@ An editor for creating enriched Cyber Kill Chain assessments by mapping MITRE AT
 
 ### Work in progress 
 
-![Version](https://img.shields.io/badge/version-2.9.1-blue)
+![Version](https://img.shields.io/badge/version-2.9.2-blue)
 [![MITRE ATT&CK® 18](https://img.shields.io/badge/MITRE%20ATT%26CK®-v18-red)](https://attack.mitre.org/versions/v18/)
 ![License](https://img.shields.io/badge/license-Apache%202.0-green)
 ![Dependencies](https://img.shields.io/badge/dependencies-none-brightgreen)
diff --git a/config.js b/config.js
@@ -7,7 +7,7 @@
 
 const CONFIG = {
     // Application info
-    version: '2.9.1',
+    version: '2.9.2',
     changelogUrl: 'CHANGELOG.md',
     
     // Framework source files (for extraction scripts)
diff --git a/index.html b/index.html
@@ -1,5 +1,8 @@
 <!DOCTYPE html>
 <html lang="en">
+    <!-- AttackFlow - An editor for creating enriched Cyber Kill Chain assessments
+        Project Page: https://github.com/Pr0cella/AttackFlow
+    -->
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
@@ -4052,7 +4055,7 @@ <h4>Tips</h4>
         // ============================================================
         // VERSION - Loaded dynamically from changelog
         // ============================================================
-        let APP_VERSION = '2.9.1';  // Fallback version
+        let APP_VERSION = '2.9.2';  // Fallback version
         
         async function loadVersion() {
             try {
@@ -10023,12 +10026,12 @@ <h4>Observables</h4>
             }
             
             // Convert to CSV string
-            // KCE-SEC-004: Prefix cells starting with formula characters to prevent injection
+            // Prefix cells containing formula characters with a tab character and wraps the cell content in double quotes
             const sanitizeForCsv = (value) => {
                 const str = String(value);
-                // Prefix with single quote if starts with formula characters
+                // prefix with tab and wrap in quotes
                 if (/^[=+\-@\t\r]/.test(str)) {
-                    return "'" + str;
+                    return '"' + "\t" + str + '"';
                 }
                 return str;
             };
