π‘οΈ Sentinel: [MEDIUM] Fix CSP Hash Mismatch due to Kotlin Multiline Strings - #283
π‘οΈ Sentinel: [MEDIUM] Fix CSP Hash Mismatch due to Kotlin Multiline Strings#283seonghobae wants to merge 1 commit into
Conversation
|
π Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a π emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
π WalkthroughWalkthroughCSS μ½ν μΈ μ CSP μ€νμΌ ν΄μ μμ±μ μ μ κ°μΌλ‘ μ€μννκ³ , λλ ν°λ¦¬λ³ HTML μμ±μμ μ΄λ₯Ό μ¬μ¬μ©νλλ‘ λ³κ²½νμ΅λλ€. Kotlin λ€μ€ μ€ λ¬Έμμ΄μ CSP ν΄μ λΆμΌμΉ μλ°© μ§μΉ¨λ 보μ λ¬Έμμ μΆκ°νμ΅λλ€. ChangesCSP μ€νμΌ ν΄μ μ€μν
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: π₯ Pre-merge checks | β 5β Passed checks (5 passed)
β¨ Finishing Touchesπ Generate docstrings
π§ͺ Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
This PR addresses a CSP (Content-Security-Policy) style hash mismatch caused by whitespace/indentation artifacts from Kotlin multiline strings, ensuring the computed sha256-... hash matches the exact <style> contents injected into generated index.html files.
Changes:
- Moves the inline CSS, its SHA-256 hash computation, and the rendered
<style>block to top-levelprivate vals so the content is stable and reused. - Applies
.trimIndent()to normalize multiline CSS formatting and removes extra whitespace inside the<style>element that previously broke hash validation. - Adds a new Sentinel learning entry documenting the issue and prevention guidance.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/main/kotlin/html4tree/main.kt | Normalizes CSS multiline string formatting and centralizes CSS + CSP hash generation to prevent CSP hash mismatches. |
| .jules/sentinel.md | Documents the CSP hash mismatch root cause and prevention guidance for future hardening. |
π‘ Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
π§Ή Nitpick comments (1)
src/main/kotlin/html4tree/main.kt (1)
97-101: π Security & Privacy | π΅ Trivial | β‘ Quick winμ€μ
<style>λ³Έλ¬Έκ³Ό ν΄μμ μΌμΉλ₯Ό νκ· ν μ€νΈλ‘ κ²μ¦νμΈμ.νμ¬
MainTest.kt:305-346μ CSP ν΄μμ νμκ³Ό CSS μ‘°κ°λ§ νμΈν©λλ€.cssContentμ μ€μ μ½μ λ<style>λ³Έλ¬Έμ΄ λ¬λΌλ ν μ€νΈκ° ν΅κ³Όν μ μμΌλ―λ‘, μμ±λ μ€νμΌ λ³Έλ¬Έμ μΆμΆν΄ SHA-256/Base64λ₯Ό κ³μ°ν λ€ CSPμ ν΄μμ λΉκ΅νλ κ²μ¦μ μΆκ°νμΈμ.π€ Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/kotlin/html4tree/main.kt` around lines 97 - 101, Update the regression tests around the CSP hash checks in MainTest.kt to extract the generated `<style>` elementβs actual body, compute its SHA-256 digest and Base64 value, and assert it matches the CSP hash. Keep the existing hash-format and CSS-fragment assertions, and anchor the new validation to the generated style output rather than only cssContent.
π€ Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.jules/sentinel.md:
- Around line 87-90: Update the CSP guidance in the html4tree entry to state
that hash mismatches typically cause browsers to block styles, not enable a
policy bypass. Revise the existing nonce-based guidance around the referenced
security instructions to match the current hash-based implementation, or
explicitly mark it as historical.
---
Nitpick comments:
In `@src/main/kotlin/html4tree/main.kt`:
- Around line 97-101: Update the regression tests around the CSP hash checks in
MainTest.kt to extract the generated `<style>` elementβs actual body, compute
its SHA-256 digest and Base64 value, and assert it matches the CSP hash. Keep
the existing hash-format and CSS-fragment assertions, and anchor the new
validation to the generated style output rather than only cssContent.
πͺ Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
βΉοΈ Review info
βοΈ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4f41bc2e-f37c-4395-9389-c92d002d222c
π Files selected for processing (2)
.jules/sentinel.mdsrc/main/kotlin/html4tree/main.kt
| ## 2026-07-27 - [html4tree] CSP Hash Mismatch due to Kotlin Multiline Strings | ||
| **Vulnerability:** λΈλΌμ°μ κ° CSP(Content-Security-Policy) ν΄μλ₯Ό κ³μ°ν λ, μΈλΌμΈ μ€ν¬λ¦½νΈμ μ€νμΌμ μ νν ν μ€νΈμ κΈ°λ°ν©λλ€. Kotlinμ λ€μ€ μ€ λ¬Έμμ΄ λ΄μ λΆνμν 곡백과 μ€λ°κΏμΌλ‘ μΈν΄ μμ±λ ν΄μμ λΈλΌμ°μ κ° κ³μ°ν ν΄μκ° λΆμΌμΉνμ¬, κ²°κ³Όμ μΌλ‘ μ€νμΌ μ μ©μ΄ μ€ν¨νκ±°λ 보μ μ μ± μ°ν κ°λ₯μ±μ΄ μκΉλλ€. | ||
| **Learning:** μ μ μμ± λꡬμμ CSPλ₯Ό μν΄ μ½ν μΈ ν΄μλ₯Ό κ³μ°ν λλ, μΈμ νΈλ μ½ν μΈ μ£Όλ³μ μ묡μ μ¬λ°±μ΄λ λ€μ¬μ°κΈ°κ° κ²°κ³Ό ν΄μλ₯Ό 무ν¨νν μ μμμ μΈμ§ν΄μΌ ν©λλ€. | ||
| **Prevention:** μ½ν μΈ λ¬Έμμ΄μ `.trimIndent()`λ₯Ό μ μ©νμ¬ ν΄μ± μ μ ν¬λ§·μ μ 리νκ³ , μ묡μ μ¬λ°± μμ΄(μ: `<style>${exactStyleContent}</style>`) HTMLμ μΈμ νΈνμ¬ μμ ν ν΄μ μΌμΉλ₯Ό 보μ₯νμμμ€. |
There was a problem hiding this comment.
π Security & Privacy | π‘ Minor | β‘ Quick win
CSP λΆμΌμΉμ μν₯κ³Ό κΈ°μ‘΄ nonce μ§μΉ¨μ μ μ νμΈμ.
ν΄μ λΆμΌμΉλ μΌλ°μ μΌλ‘ λΈλΌμ°μ κ° μ€νμΌμ μ°¨λ¨νλ λ¬Έμ μ΄μ§, 보μ μ μ± μ°νλ₯Ό κ°λ₯νκ² νλ λ¬Έμ λ μλλλ€. λν 24νμ nonce κΈ°λ° μ§μΉ¨μ΄ νμ¬μ hash κΈ°λ° κ΅¬νκ³Ό μΆ©λνλ―λ‘, κΈ°μ‘΄ νλͺ©μ hash λ°©μμΌλ‘ κ°±μ νκ±°λ μμ¬μ μ§μΉ¨μμ λͺ νν νμνμΈμ.
π€ Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.jules/sentinel.md around lines 87 - 90, Update the CSP guidance in the
html4tree entry to state that hash mismatches typically cause browsers to block
styles, not enable a policy bypass. Revise the existing nonce-based guidance
around the referenced security instructions to match the current hash-based
implementation, or explicitly mark it as historical.
|
Closing as superseded by canonical #363. Both normalize the multiline stylesheet and inject it without template padding, but #363 additionally proves byte identity through an independent real generated-file digest oracle, adds one-time hashing, APA 7 doctoring, changelog, and fresh current-head CI/JaCoCo/security evidence. No result from this duplicate head is reused. |
Understood. Acknowledging that this work is now obsolete and stopping work on this task. |
π¨ Severity: MEDIUM
π‘ Vulnerability: Kotlin λ€μ€ μ€ λ¬Έμμ΄μ 곡백 λ° λ€μ¬μ°κΈ° λλ¬Έμ κ³μ°λ CSP ν΄μμ μ€μ μ£Όμ λ
<style>λ΄μ©μ ν΄μκ° μΌμΉνμ§ μμ 보μ μ μ± μ΄ μ¬λ°λ₯΄κ² μ μ©λμ§ μλ λ¬Έμ κ° μμμ΅λλ€.π― Impact: λΈλΌμ°μ μμ μΈλΌμΈ μ€νμΌμ΄ CSPμ μν΄ μ°¨λ¨λκ±°λ, λΆμ νν ν΄μλ‘ μΈν΄ 보μ μ μ± κ²μ¦μ΄ μ€ν¨ν μ μμ΅λλ€.
π§ Fix:
cssContent,styleHash,cssμ μΈμ μ΅μμprivate valμμλ‘ μ΄λνκ³.trimIndent()λ₯Ό μ¬μ©νμ¬ κ³΅λ°±μ μ κ±°,<style>νκ·Έμ μ¬λ°± μμ΄ λ΄μ©μ μ½μ νλλ‘ μμ νμ΅λλ€.β Verification:
export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64 && ./gradlew clean test jacocoTestReport jacocoTestCoverageVerification --continueλͺ λ Ήμ ν΅ν΄ 100% ν μ€νΈ 컀λ²λ¦¬μ§λ₯Ό κ²μ¦νμ΅λλ€.PR created automatically by Jules for task 10525982417683885382 started by @seonghobae
Summary by CodeRabbit
λ²κ·Έ μμ
보μ