ContextualWisdomLab · seonghobae · Jul 30, 2026
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
@@ -38,3 +38,7 @@
 **Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`.
 **Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation.
 **Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth.
+## 2026-07-30 - Fix base-uri injection risk in strict CSP
+**Vulnerability:** The Content Security Policy for the main page allowed `base-uri 'self'`, which could theoretically permit base tag injection if an attacker could upload or craft a same-origin resource, altering relative URL resolutions.
+**Learning:** For static sites that do not explicitly require a `<base>` tag, allowing `base-uri 'self'` is overly permissive.
+**Prevention:** Always use `base-uri 'none'` in CSP for applications that don't need to change their base URL dynamically, fully mitigating base tag injection risks.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # CHANGELOG
 
 ## [Unreleased]
+- **보안 개선**: 정적 사이트의 CSP에서 `<base>` 태그 인젝션을 원천 차단하기 위해 `base-uri 'none'`을 적용했습니다.
 - **보안 개선**: 컴포넌트 갤러리의 인라인 스크립트와 스타일을 외부 파일로 분리하고, 엄격한 Content-Security-Policy를 적용해 XSS 방어를 강화했습니다.
 - **성능 회귀 복원**: 오프스크린 `.section` 렌더링을 `content-visibility: auto`로 지연하고, 일반 섹션은 600px·콘텐츠가 큰 DIKW/projects 섹션은 1000px의 `contain-intrinsic-size` placeholder를 유지해 초기 렌더링 비용과 스크롤바 이동을 함께 줄였습니다.
 - **보안 개선**: Trusted Types 기반 CSP 강화: 잠재적인 DOM 기반 XSS 공격을 방지하기 위해 `require-trusted-types-for 'script'` 지시어 추가

diff --git a/index.html b/index.html
@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self'; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests; require-trusted-types-for 'script';">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests; require-trusted-types-for 'script';">
     <meta name="referrer" content="strict-origin-when-cross-origin">
     <title>맥락지혜 연구실 | Contextual Wisdom Lab</title>
     <meta

diff --git a/tests/test_index_security.py b/tests/test_index_security.py
@@ -0,0 +1,19 @@
+"""Security regression tests for the main application."""
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+INDEX = ROOT / "index.html"
+
+def test_index_declares_strict_base_uri() -> None:
+    """The main index.html must use base-uri 'none' to prevent base tag injection."""
+    html = INDEX.read_text(encoding="utf-8")
+    match = re.search(
+        r'<meta\s+http-equiv="Content-Security-Policy"\s+content="([^"]+)"',
+        html,
+    )
+    assert match is not None, "index.html must declare a CSP meta policy"
+    policy = match.group(1)
+
+    assert "base-uri 'none'" in policy