Skip to content

πŸ›‘οΈ Sentinel: 검색 엔진 인덱싱 방지λ₯Ό μœ„ν•œ robots 메타 νƒœκ·Έ μΆ”κ°€ #285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 1 commit into from
+8 βˆ’0
Closed

πŸ›‘οΈ Sentinel: 검색 엔진 인덱싱 방지λ₯Ό μœ„ν•œ robots 메타 νƒœκ·Έ μΆ”κ°€ #285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,3 +83,8 @@
**Vulnerability:** 정적 HTML 생성 λ„κ΅¬μ—μ„œ 맀번 λ‹€λ₯Έ Nonceλ₯Ό λ™μ μœΌλ‘œ μƒμ„±ν•˜μ—¬ CSP에 μ μš©ν•˜λŠ” 것은, 캐싱 νš¨μœ¨μ„ μ €ν•˜μ‹œν‚¬ 뿐만 μ•„λ‹ˆλΌ 정적 배포 ν™˜κ²½(예: GitHub Pages λ“±)μ—μ„œ μ˜¬λ°”λ₯Έ λ³΄μ•ˆ μ •μ±… μˆ˜λ¦½μ„ λ°©ν•΄ν•  수 μžˆλŠ” μ•ˆν‹° νŒ¨ν„΄μž…λ‹ˆλ‹€.
**Learning:** μ •μ μœΌλ‘œ κ³ μ •λœ 인라인 μŠ€νƒ€μΌμ΄λ‚˜ μŠ€ν¬λ¦½νŠΈμ—λŠ” λ‚œμˆ˜ν™”λœ Nonce보닀 μ½˜ν…μΈ  자체의 ν•΄μ‹œ(SHA-256 λ“±)λ₯Ό μ‚¬μš©ν•˜λŠ” 것이 μ•ˆμ „ν•˜κ³  μΌκ΄€λœ λ°©μ‹μž„μ„ λ°°μ› μŠ΅λ‹ˆλ‹€.
**Prevention:** μžλ™ μƒμ„±λ˜λŠ” 정적 HTML의 μ½˜ν…μΈ  λ³΄μ•ˆ μ •μ±…(CSP)μ—λŠ” `style-src 'sha256-<HASH>'` 방식을 μ μš©ν•˜κ³ , `<style>` νƒœκ·Έμ—μ„œ λΆˆν•„μš”ν•œ `nonce` 속성을 μ œκ±°ν•˜μ—¬ λΈŒλΌμš°μ €μ˜ 무결성 검증 κΈ°λŠ₯을 적극 ν™œμš©ν•˜μ‹­μ‹œμ˜€.

## 2024-07-15 - [html4tree] μžλ™ μƒμ„±λœ HTML 디렉토리 인덱슀의 정보 λ…ΈμΆœ 방지
**Vulnerability:** 곡개 μ›Ή μ„œλ²„μ— ν˜ΈμŠ€νŒ…λœ μžλ™ 생성 디렉토리 μΈλ±μŠ€κ°€ 검색 엔진에 μ˜ν•΄ λ¬΄λ‹¨μœΌλ‘œ 크둀링 및 색인화될 수 μžˆλŠ” 정보 λ…ΈμΆœ (Information Exposure) μœ„ν—˜.
**Learning:** κΈ°λ³Έ μ œκ³΅λ˜λŠ” 메타 νƒœκ·Έλ₯Ό λͺ…μ‹œμ μœΌλ‘œ μ„€μ •ν•˜μ§€ μ•ŠμœΌλ©΄, 검색 엔진 봇은 둜컬 ν™˜κ²½μ„ μœ„ν•΄ μƒμ„±λœ 정적 디렉토리 파일 κ΅¬μ‘°κΉŒμ§€ μˆ˜μ§‘ν•˜μ—¬ 외뢀에 λ…ΈμΆœμ‹œν‚¬ 수 μžˆμŠ΅λ‹ˆλ‹€.
**Prevention:** HTML 기반의 파일 ꡬ쑰 λΈŒλΌμš°μ €λ₯Ό λ Œλ”λ§ν•  λ•ŒλŠ” 항상 `<meta name="robots" content="noindex, nofollow">` νƒœκ·Έλ₯Ό μ‚½μž…ν•˜μ—¬ 검색 엔진 λ΄‡μ˜ μ ‘κ·Ό 및 색인을 μ°¨λ‹¨ν•˜μ‹­μ‹œμ˜€.
2 changes: 2 additions & 0 deletions src/main/kotlin/html4tree/main.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -327,6 +327,8 @@ ${cssContent} </style>
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src '${styleHash}'; base-uri 'none'; form-action 'none';">
<!-- λ³΄μ•ˆ ν–₯상: 리퍼러λ₯Ό ν†΅ν•œ 디렉토리 경둜 λ…ΈμΆœ 방지 -->
<meta name="referrer" content="no-referrer">
<!-- λ³΄μ•ˆ ν–₯상: 검색 엔진 인덱싱을 ν†΅ν•œ 정보 λ…ΈμΆœ 방지 -->
<meta name="robots" content="noindex, nofollow">
Comment on lines +330 to +331

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ”’ Security & Privacy | 🟠 Major | πŸ—οΈ Heavy lift

robots 메타 νƒœκ·Έλ₯Ό μ ‘κ·Ό μ œμ–΄ μˆ˜λ‹¨μœΌλ‘œ μ·¨κΈ‰ν•˜μ§€ λ§ˆμ„Έμš”. noindex, nofollowλŠ” 이미 κ°€μ Έμ˜¨ νŽ˜μ΄μ§€μ˜ 색인 및 링크 좔적을 μ œν•œν•  뿐, ν¬λ‘€λ§μ΄λ‚˜ 직접 접근을 μ°¨λ‹¨ν•˜μ§€ μ•ŠμŠ΅λ‹ˆλ‹€.

  • src/main/kotlin/html4tree/main.kt#L330-L331: 색인 λ°©μ§€μš© 메타 νƒœκ·ΈλŠ” μœ μ§€ν•˜λ˜, 크둀링 방지가 ν•„μš”ν•˜λ©΄ robots.txt λ˜λŠ” μ„œλ²„ μΈ‘ μ ‘κ·Ό μ œμ–΄λ₯Ό μΆ”κ°€ν•˜μ„Έμš”.
  • .jules/sentinel.md#L87-L90: 메타 νƒœκ·Έκ°€ λ΄‡μ˜ μ ‘κ·ΌκΉŒμ§€ μ°¨λ‹¨ν•œλ‹€λŠ” μ„€λͺ…을 μˆ˜μ •ν•˜κ³ , λ―Όκ°ν•œ μ •λ³΄μ—λŠ” 곡개 ν˜ΈμŠ€νŒ… κΈˆμ§€ λ˜λŠ” 인증이 ν•„μš”ν•˜λ‹€λŠ” 점을 λͺ…μ‹œν•˜μ„Έμš”.
πŸ“ Affects 2 files
  • src/main/kotlin/html4tree/main.kt#L330-L331 (this comment)
  • .jules/sentinel.md#L87-L90
πŸ€– Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main/kotlin/html4tree/main.kt` around lines 330 - 331,
src/main/kotlin/html4tree/main.kt:330-331의 robots 메타 νƒœκ·ΈλŠ” 색인 방지 λͺ©μ μœΌλ‘œ μœ μ§€ν•˜λ˜ μ ‘κ·Ό μ œμ–΄
μˆ˜λ‹¨μœΌλ‘œ ν™•μž₯ν•˜μ§€ 말고, 크둀링 차단이 ν•„μš”ν•˜λ©΄ robots.txt λ˜λŠ” μ„œλ²„ μΈ‘ μ ‘κ·Ό μ œμ–΄λ₯Ό μΆ”κ°€ν•˜μ„Έμš”.
.jules/sentinel.md:87-90μ—μ„œλŠ” 메타 νƒœκ·Έκ°€ 봇 μ ‘κ·ΌκΉŒμ§€ μ°¨λ‹¨ν•œλ‹€λŠ” μ„€λͺ…을 μˆ˜μ •ν•˜κ³ , λ―Όκ°ν•œ μ •λ³΄λŠ” 곡개 ν˜ΈμŠ€νŒ…μ„ κΈˆμ§€ν•˜κ±°λ‚˜
인증으둜 λ³΄ν˜Έν•΄μ•Ό ν•œλ‹€κ³  λͺ…μ‹œν•˜μ„Έμš”.

<title>${curr_dir.getName().escapeHtml()}</title>
${css}
</head>
Expand Down
1 change: 1 addition & 0 deletions src/test/kotlin/html4tree/MainTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,6 +309,7 @@ class MainTest {
val htmlContent = indexFile.readText()
assertTrue(htmlContent.contains("<html lang=\"ko\">"))
assertTrue(htmlContent.contains("<meta name=\"color-scheme\" content=\"light dark\">"))
assertTrue(htmlContent.contains("<meta name=\"robots\" content=\"noindex, nofollow\">"))
assertTrue(htmlContent.contains("<nav aria-label=\"디렉토리 λͺ©λ‘\">"))
assertTrue(htmlContent.contains("role=\"list\""))
assertTrue(htmlContent.contains("<main>"))
Expand Down
Loading