[GH-ISSUE #1811] [Bug]: CSV Import can corrupt the database by saving invalid entries #7620

New Issue

GiteaMirror · 2026-04-10T17:31:07-05:00

GiteaMirror commented

2026-04-10 17:31:07 -05:00

Originally created by @Shazib on GitHub (Oct 17, 2023).
Original GitHub issue: https://github.com/actualbudget/actual/issues/1811

Verified issue does not already exist?

I have searched and found no existing issue

What happened?

Originally impacted a user on fly.io, discord support thread here

Importing a CSV with an invalid (huge?) number, corrupts the database, and makes actual fail to load subsequently.

Reproduce by importing the following as a CSV:

Post Date,Description,Category,Reference Number,Amount
7/22/2023,BACKERKIT.COM GLOOMHAV   PACIFIC GROVECA,Miscellaneous General Merchandise Stores,8271116503061807,-15.00

Result:
"Fatal Erro" app fails to load permanantly.

Notes:

The parsing logic strips out evertything that isn't a digit with regex and has its own implementation of safeNumber?

https://github.com/actualbudget/actual/blob/master/packages/loot-core/src/shared/util.ts#L327-L353

The CSV Parser should possibly also validate that each row has the same number of columns, as the CSV had comma's in the content body.

What error did you receive?

Where are you hosting Actual?

Fly.io

What browsers are you seeing the problem on?

Firefox

Operating System

Windows 11

Originally created by @Shazib on GitHub (Oct 17, 2023). Original GitHub issue: https://github.com/actualbudget/actual/issues/1811 ### Verified issue does not already exist? - [X] I have searched and found no existing issue ### What happened? Originally impacted a user on fly.io, discord support thread [here](https://discord.com/channels/937901803608096828/1162801618115375196) Importing a CSV with an invalid (huge?) number, corrupts the database, and makes actual fail to load subsequently. Reproduce by importing the following as a CSV: ``` Post Date,Description,Category,Reference Number,Amount 7/22/2023,BACKERKIT.COM GLOOMHAV PACIFIC GROVECA,Miscellaneous General Merchandise Stores,8271116503061807,-15.00 ``` Result: "Fatal Erro" app fails to load permanantly. Notes: The parsing logic strips out evertything that isn't a digit with regex and has its own implementation of safeNumber? https://github.com/actualbudget/actual/blob/master/packages/loot-core/src/shared/util.ts#L327-L353 The CSV Parser should possibly also validate that each row has the same number of columns, as the CSV had comma's in the content body. ### What error did you receive? ![image](https://github.com/actualbudget/actual/assets/4405777/8b5e0497-305e-46e7-8b6d-907a737eb0c0) ### Where are you hosting Actual? Fly.io ### What browsers are you seeing the problem on? Firefox ### Operating System Windows 11

GiteaMirror added the transaction import bug needs info labels 2026-04-10 17:31:07 -05:00

GiteaMirror closed this issue

2026-04-10 17:31:08 -05:00

GiteaMirror commented

2026-04-10 17:31:09 -05:00

@MatissJanis commented on GitHub (Mar 21, 2024):

👋 I am no longer able to reproduce this. Can you please double check?

Thanks!

@MatissJanis commented on GitHub (Mar 21, 2024): 👋 I am no longer able to reproduce this. Can you please double check? Thanks!

GiteaMirror commented

2026-04-10 17:31:10 -05:00

@Shazib commented on GitHub (Mar 23, 2024):

Sorry i think my examples wrong or it changed

Post Date,Description,Category,Reference Number,Amount
7/22/2023,BACKERKIT.COM GLOOMHAV   PACIFIC GROVECA,Miscellaneous General Merchandise Stores,8271116503061807,8271116503061807

Try that, deffo fails in the same way

@Shazib commented on GitHub (Mar 23, 2024): Sorry i think my examples wrong or it changed ``` Post Date,Description,Category,Reference Number,Amount 7/22/2023,BACKERKIT.COM GLOOMHAV PACIFIC GROVECA,Miscellaneous General Merchandise Stores,8271116503061807,8271116503061807 ``` Try that, deffo fails in the same way