Collaborator

Fixes CSV separators not being validated.

Changes proposed in this PR:

• Refactor the sep_param method in usage_controller to validate that the provided CSV field separator is a safe, predefined character.
• This mitigates a CSV injection vulnerability where a crafted request such as
  /usage_yearly_users?sep=%2c%3dcmd|' /C+powershell'!A0++pbiqh
  could embed a malicious formula into the downloaded CSV. When opened in spreadsheet software (like Excel), it could trigger command execution under certain conditions.

Validate CSV Separator

21c466e

Add changelog entry

c545f6d

aaronskiba approved these changes Oct 6, 2025

View reviewed changes

Merge next-release/v5.0.2 into main #3570