From 3feb9d3878a848348eb5f8f720f4f87a9ceb534b Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Fri, 31 Jul 2026 14:02:51 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[security?= =?UTF-8?q?=20improvement]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ๐Ÿšจ Severity: MEDIUM ๐Ÿ’ก Vulnerability: index.html์˜ Content-Security-Policy์— base-uri 'self'๊ฐ€ ์„ค์ •๋˜์–ด ์žˆ์–ด, HTML ์ฃผ์ž… ์ทจ์•ฝ์ ์ด ์กด์žฌํ•  ๊ฒฝ์šฐ Base ํƒœ๊ทธ ์ธ์ ์…˜ ๊ณต๊ฒฉ์— ๋…ธ์ถœ๋  ์ˆ˜ ์žˆ์Œ. ๐ŸŽฏ Impact: ๊ณต๊ฒฉ์ž๊ฐ€ ์•…์˜์ ์ธ ํƒœ๊ทธ๋ฅผ ์ฃผ์ž…ํ•˜๋ฉด ์ƒ๋Œ€ ๊ฒฝ๋กœ๋กœ ๋กœ๋“œ๋˜๋Š” ์Šคํฌ๋ฆฝํŠธ๋‚˜ ์Šคํƒ€์ผ์‹œํŠธ๊ฐ€ ๊ณต๊ฒฉ์ž์˜ ๋„๋ฉ”์ธ์—์„œ ๋กœ๋“œ๋˜์–ด ์ถ”๊ฐ€์ ์ธ ๊ณต๊ฒฉ(์˜ˆ: XSS)์œผ๋กœ ์ด์–ด์งˆ ์ˆ˜ ์žˆ์Œ. ๐Ÿ”ง Fix: CSP์˜ base-uri ์ง€์‹œ์–ด๋ฅผ 'none'์œผ๋กœ ๋ณ€๊ฒฝํ•˜์—ฌ Base ํƒœ๊ทธ ์ธ์ ์…˜์„ ์›์ฒœ์ ์œผ๋กœ ์ฐจ๋‹จํ•จ. ์ •์  ์‚ฌ์ดํŠธ์ด๋ฏ€๋กœ ํƒœ๊ทธ๊ฐ€ ํ•„์š”ํ•˜์ง€ ์•Š์Œ. โœ… Verification: pytest tests/๋ฅผ ์‹คํ–‰ํ•˜์—ฌ CSP base-uri ํ…Œ์ŠคํŠธ๊ฐ€ ํ†ต๊ณผํ•˜๋Š”์ง€ ํ™•์ธํ•จ. --- .jules/sentinel.md | 4 ++++ CHANGELOG.md | 1 + index.html | 2 +- tests/test_index_security.py | 18 ++++++++++++++++++ 4 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 tests/test_index_security.py diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 4f173bc..9223ef3 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -38,3 +38,7 @@ **Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`. **Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation. **Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth. +## 2026-07-31 - Enforce strict base-uri in CSP +**Vulnerability:** The Content Security Policy in `index.html` allowed `base-uri 'self'`, which could potentially allow base tag injection if an attacker finds a way to inject HTML. +**Learning:** Static sites that do not explicitly require a `` tag should use `base-uri 'none'` instead of `base-uri 'self'` to completely neutralize base tag injection attacks. +**Prevention:** Always configure `base-uri 'none'` in the baseline CSP for static sites to prevent base tag injection attacks. diff --git a/CHANGELOG.md b/CHANGELOG.md index 56ad628..9c9907e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # CHANGELOG ## [Unreleased] +- **๋ณด์•ˆ ๊ฐœ์„ **: `index.html`์˜ Content-Security-Policy(CSP)์— `base-uri 'none'`์„ ์„ค์ •ํ•˜์—ฌ Base ํƒœ๊ทธ ์ธ์ ์…˜ ๊ณต๊ฒฉ์„ ๋ฐฉ์ง€ํ•˜๋„๋ก ๋ณด์•ˆ์„ ๊ฐ•ํ™”ํ–ˆ์Šต๋‹ˆ๋‹ค. - **๋ณด์•ˆ ๊ฐœ์„ **: ์ปดํฌ๋„ŒํŠธ ๊ฐค๋Ÿฌ๋ฆฌ์˜ ์ธ๋ผ์ธ ์Šคํฌ๋ฆฝํŠธ์™€ ์Šคํƒ€์ผ์„ ์™ธ๋ถ€ ํŒŒ์ผ๋กœ ๋ถ„๋ฆฌํ•˜๊ณ , ์—„๊ฒฉํ•œ Content-Security-Policy๋ฅผ ์ ์šฉํ•ด XSS ๋ฐฉ์–ด๋ฅผ ๊ฐ•ํ™”ํ–ˆ์Šต๋‹ˆ๋‹ค. - **์„ฑ๋Šฅ ํšŒ๊ท€ ๋ณต์›**: ์˜คํ”„์Šคํฌ๋ฆฐ `.section` ๋ Œ๋”๋ง์„ `content-visibility: auto`๋กœ ์ง€์—ฐํ•˜๊ณ , ์ผ๋ฐ˜ ์„น์…˜์€ 600pxยท์ฝ˜ํ…์ธ ๊ฐ€ ํฐ DIKW/projects ์„น์…˜์€ 1000px์˜ `contain-intrinsic-size` placeholder๋ฅผ ์œ ์ง€ํ•ด ์ดˆ๊ธฐ ๋ Œ๋”๋ง ๋น„์šฉ๊ณผ ์Šคํฌ๋กค๋ฐ” ์ด๋™์„ ํ•จ๊ป˜ ์ค„์˜€์Šต๋‹ˆ๋‹ค. - **๋ณด์•ˆ ๊ฐœ์„ **: Trusted Types ๊ธฐ๋ฐ˜ CSP ๊ฐ•ํ™”: ์ž ์žฌ์ ์ธ DOM ๊ธฐ๋ฐ˜ XSS ๊ณต๊ฒฉ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•ด `require-trusted-types-for 'script'` ์ง€์‹œ์–ด ์ถ”๊ฐ€ diff --git a/index.html b/index.html index c40fea3..25ee55a 100644 --- a/index.html +++ b/index.html @@ -3,7 +3,7 @@ - + ๋งฅ๋ฝ์ง€ํ˜œ ์—ฐ๊ตฌ์‹ค | Contextual Wisdom Lab None: + """The main index.html enforces a strict base-uri to prevent base tag injection.""" + html = INDEX.read_text(encoding="utf-8") + match = re.search( + r'