Skip to content

πŸ›‘οΈ Sentinel: [security improvement] λ°©μ§€ μ˜λ„ν•˜μ§€ μ•Šμ€ 정보 λ…ΈμΆœ (검색 μ—”μ§„ 인덱싱 μ œν•œ) - #261

Closed
seonghobae wants to merge 1 commit into
masterfrom
sentinel-security-noindex-7301576460132431105
Closed

πŸ›‘οΈ Sentinel: [security improvement] λ°©μ§€ μ˜λ„ν•˜μ§€ μ•Šμ€ 정보 λ…ΈμΆœ (검색 μ—”μ§„ 인덱싱 μ œν•œ)#261
seonghobae wants to merge 1 commit into
masterfrom
sentinel-security-noindex-7301576460132431105

Conversation

@seonghobae

Copy link
Copy Markdown
Collaborator
  • 🚨 Severity: MEDIUM
  • πŸ’‘ Vulnerability: μƒμ„±λœ 디렉토리 λͺ©λ‘ νŽ˜μ΄μ§€κ°€ 검색 엔진에 μ˜ν•΄ μ˜λ„μΉ˜ μ•Šκ²Œ 인덱싱될 수 μžˆλŠ” 정보 λ…ΈμΆœ (Information Exposure) μœ„ν—˜.
  • 🎯 Impact: μ€‘μš” 파일, μ†ŒμŠ€ μ½”λ“œ ꡬ쑰, λ―Όκ°ν•œ λ¬Έμ„œ 등이 검색 μ—”μ§„ 검색 결과에 λ…ΈμΆœλ˜μ–΄ μ•…μ˜μ μΈ κ³΅κ²©μžμ—κ²Œ μˆ˜μ§‘λ  수 μžˆμŠ΅λ‹ˆλ‹€.
  • πŸ”§ Fix: noindex, nofollow 값이 ν¬ν•¨λœ <meta name="robots"> νƒœκ·Έλ₯Ό μΆ”κ°€ν•˜μ—¬ 정상적인 ν¬λ‘€λŸ¬κ°€ νŽ˜μ΄μ§€λ₯Ό μΈλ±μ‹±ν•˜κ³  링크λ₯Ό λ”°λΌκ°€λŠ” 것을 μ œν•œν•©λ‹ˆλ‹€.
  • βœ… Verification: λ‹¨μœ„ ν…ŒμŠ€νŠΈκ°€ μΆ”κ°€λ˜μ—ˆμœΌλ©°, μƒμ„±λœ HTML 파일의 헀더에 μ˜¬λ°”λ₯΄κ²Œ μ μš©λ˜λŠ”μ§€ ν…ŒμŠ€νŠΈν–ˆμŠ΅λ‹ˆλ‹€.

PR created automatically by Jules for task 7301576460132431105 started by @seonghobae

μƒμ„±λœ 디렉토리 λͺ©λ‘ νŽ˜μ΄μ§€κ°€ μ˜λ„μΉ˜ μ•Šκ²Œ 검색 엔진에 μΈλ±μ‹±λ˜λŠ” 정보 λ…ΈμΆœ μœ„ν—˜μ„
λ°©μ§€ν•˜κΈ° μœ„ν•΄ <meta name="robots" content="noindex, nofollow"> νƒœκ·Έλ₯Ό μΆ”κ°€ν–ˆμŠ΅λ‹ˆλ‹€.
@google-labs-jules

Copy link
Copy Markdown

πŸ‘‹ Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a πŸ‘€ emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

Copilot AI review requested due to automatic review settings July 24, 2026 20:53

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR strengthens the security posture of html4tree’s generated index.html directory listings by preventing unintended search engine indexing, reducing the risk of information exposure when these files are published.

Changes:

  • Adds a <meta name="robots" content="noindex, nofollow"> tag to the generated HTML <head> to discourage indexing and link-following by compliant crawlers.
  • Extends unit tests to verify the robots meta tag is present in generated output for both empty directories and normal directory listings.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
src/main/kotlin/html4tree/main.kt Adds the robots meta tag to the HTML head template used for generated directory index pages.
src/test/kotlin/html4tree/MainTest.kt Adds assertions verifying the new meta tag is present in generated HTML content.

πŸ’‘ Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head c83b864fc28900c1dc16a48dd2863fe053f14773.

  • Head SHA: c83b864fc28900c1dc16a48dd2863fe053f14773

  • Workflow run: 30424286949

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

@opencode-agent

Copy link
Copy Markdown

OpenCode Review Overview

  • Head SHA: c83b864fc28900c1dc16a48dd2863fe053f14773
  • Workflow run: 30424286949
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head c83b864fc28900c1dc16a48dd2863fe053f14773.

  • Head SHA: c83b864fc28900c1dc16a48dd2863fe053f14773

  • Workflow run: 30424286949

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

Copy link
Copy Markdown
Collaborator Author

Closing as superseded by draft canonical #349. The identical noindex, nofollow hint is retained there with an accurate limitation: it influences supporting crawlers only after they fetch the page and cannot replace removal, authentication, or server-side authorization for confidential content. #349 remains blocked for post-#363 update, APA 7 Google Search Central doctoring, changelog, product tests, exact-head checks, and independent approval. No evidence from this duplicate head is reused.

@seonghobae seonghobae closed this Aug 5, 2026
@google-labs-jules

Copy link
Copy Markdown

Closing as superseded by draft canonical #349. The identical noindex, nofollow hint is retained there with an accurate limitation: it influences supporting crawlers only after they fetch the page and cannot replace removal, authentication, or server-side authorization for confidential content. #349 remains blocked for post-#363 update, APA 7 Google Search Central doctoring, changelog, product tests, exact-head checks, and independent approval. No evidence from this duplicate head is reused.

Understood. Acknowledging that this work is now superseded by #349 and stopping work on this task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants