From e185e4a54dd0c64feffd204d1bd0fa0c8e43a73e Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Thu, 30 Jul 2026 13:43:29 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[security?= =?UTF-8?q?=20improvement]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ๐Ÿšจ Severity: MEDIUM ๐Ÿ’ก Vulnerability: CSP `base-uri 'self'` allows base tag injection if attacker hosts resources on same-origin. ๐ŸŽฏ Impact: Base tag injection can hijack relative URLs across the application. ๐Ÿ”ง Fix: Set `base-uri 'none'` in CSP for index.html as the application does not dynamically manipulate base URLs. โœ… Verification: Ran `pytest tests/test_index_security.py` verifying CSP `base-uri` rule. --- .jules/sentinel.md | 4 ++++ CHANGELOG.md | 1 + index.html | 2 +- tests/test_index_security.py | 19 +++++++++++++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 tests/test_index_security.py diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 4f173bc..f30faec 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -38,3 +38,7 @@ **Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`. **Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation. **Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth. +## 2026-07-30 - Fix base-uri injection risk in strict CSP +**Vulnerability:** The Content Security Policy for the main page allowed `base-uri 'self'`, which could theoretically permit base tag injection if an attacker could upload or craft a same-origin resource, altering relative URL resolutions. +**Learning:** For static sites that do not explicitly require a `` tag, allowing `base-uri 'self'` is overly permissive. +**Prevention:** Always use `base-uri 'none'` in CSP for applications that don't need to change their base URL dynamically, fully mitigating base tag injection risks. diff --git a/CHANGELOG.md b/CHANGELOG.md index 56ad628..ac188b2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # CHANGELOG ## [Unreleased] +- **๋ณด์•ˆ ๊ฐœ์„ **: ์ •์  ์‚ฌ์ดํŠธ์˜ CSP์—์„œ `` ํƒœ๊ทธ ์ธ์ ์…˜์„ ์›์ฒœ ์ฐจ๋‹จํ•˜๊ธฐ ์œ„ํ•ด `base-uri 'none'`์„ ์ ์šฉํ–ˆ์Šต๋‹ˆ๋‹ค. - **๋ณด์•ˆ ๊ฐœ์„ **: ์ปดํฌ๋„ŒํŠธ ๊ฐค๋Ÿฌ๋ฆฌ์˜ ์ธ๋ผ์ธ ์Šคํฌ๋ฆฝํŠธ์™€ ์Šคํƒ€์ผ์„ ์™ธ๋ถ€ ํŒŒ์ผ๋กœ ๋ถ„๋ฆฌํ•˜๊ณ , ์—„๊ฒฉํ•œ Content-Security-Policy๋ฅผ ์ ์šฉํ•ด XSS ๋ฐฉ์–ด๋ฅผ ๊ฐ•ํ™”ํ–ˆ์Šต๋‹ˆ๋‹ค. - **์„ฑ๋Šฅ ํšŒ๊ท€ ๋ณต์›**: ์˜คํ”„์Šคํฌ๋ฆฐ `.section` ๋ Œ๋”๋ง์„ `content-visibility: auto`๋กœ ์ง€์—ฐํ•˜๊ณ , ์ผ๋ฐ˜ ์„น์…˜์€ 600pxยท์ฝ˜ํ…์ธ ๊ฐ€ ํฐ DIKW/projects ์„น์…˜์€ 1000px์˜ `contain-intrinsic-size` placeholder๋ฅผ ์œ ์ง€ํ•ด ์ดˆ๊ธฐ ๋ Œ๋”๋ง ๋น„์šฉ๊ณผ ์Šคํฌ๋กค๋ฐ” ์ด๋™์„ ํ•จ๊ป˜ ์ค„์˜€์Šต๋‹ˆ๋‹ค. - **๋ณด์•ˆ ๊ฐœ์„ **: Trusted Types ๊ธฐ๋ฐ˜ CSP ๊ฐ•ํ™”: ์ž ์žฌ์ ์ธ DOM ๊ธฐ๋ฐ˜ XSS ๊ณต๊ฒฉ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•ด `require-trusted-types-for 'script'` ์ง€์‹œ์–ด ์ถ”๊ฐ€ diff --git a/index.html b/index.html index c40fea3..25ee55a 100644 --- a/index.html +++ b/index.html @@ -3,7 +3,7 @@ - + ๋งฅ๋ฝ์ง€ํ˜œ ์—ฐ๊ตฌ์‹ค | Contextual Wisdom Lab None: + """The main index.html must use base-uri 'none' to prevent base tag injection.""" + html = INDEX.read_text(encoding="utf-8") + match = re.search( + r'