Skip to content

πŸ›‘οΈ Sentinel: 검색 엔진 연동 정보 λ…ΈμΆœ 방지 #304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 2 commits into from
+8 βˆ’0
Closed

πŸ›‘οΈ Sentinel: 검색 엔진 연동 정보 λ…ΈμΆœ 방지 #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4c46525
πŸ›‘οΈ Sentinel: 검색 엔진 연동 정보 λ…ΈμΆœ 방지
seonghobae Jul 29, 2026
852ea0c
Merge branch 'master' into sentinel/prevent-search-engine-indexing-12…
opencode-agent[bot] Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,3 +83,8 @@
**Vulnerability:** 정적 HTML 생성 λ„κ΅¬μ—μ„œ 맀번 λ‹€λ₯Έ Nonceλ₯Ό λ™μ μœΌλ‘œ μƒμ„±ν•˜μ—¬ CSP에 μ μš©ν•˜λŠ” 것은, 캐싱 νš¨μœ¨μ„ μ €ν•˜μ‹œν‚¬ 뿐만 μ•„λ‹ˆλΌ 정적 배포 ν™˜κ²½(예: GitHub Pages λ“±)μ—μ„œ μ˜¬λ°”λ₯Έ λ³΄μ•ˆ μ •μ±… μˆ˜λ¦½μ„ λ°©ν•΄ν•  수 μžˆλŠ” μ•ˆν‹° νŒ¨ν„΄μž…λ‹ˆλ‹€.
**Learning:** μ •μ μœΌλ‘œ κ³ μ •λœ 인라인 μŠ€νƒ€μΌμ΄λ‚˜ μŠ€ν¬λ¦½νŠΈμ—λŠ” λ‚œμˆ˜ν™”λœ Nonce보닀 μ½˜ν…μΈ  자체의 ν•΄μ‹œ(SHA-256 λ“±)λ₯Ό μ‚¬μš©ν•˜λŠ” 것이 μ•ˆμ „ν•˜κ³  μΌκ΄€λœ λ°©μ‹μž„μ„ λ°°μ› μŠ΅λ‹ˆλ‹€.
**Prevention:** μžλ™ μƒμ„±λ˜λŠ” 정적 HTML의 μ½˜ν…μΈ  λ³΄μ•ˆ μ •μ±…(CSP)μ—λŠ” `style-src 'sha256-<HASH>'` 방식을 μ μš©ν•˜κ³ , `<style>` νƒœκ·Έμ—μ„œ λΆˆν•„μš”ν•œ `nonce` 속성을 μ œκ±°ν•˜μ—¬ λΈŒλΌμš°μ €μ˜ 무결성 검증 κΈ°λŠ₯을 적극 ν™œμš©ν•˜μ‹­μ‹œμ˜€.

## 2026-07-29 - [html4tree] 검색 엔진 인덱싱을 ν†΅ν•œ 정보 λ…ΈμΆœ (Information Exposure)
**Vulnerability:** 정적 HTML 디렉토리 μΈλ±μ„œκ°€ 곡개 μ›Ή μ„œλ²„μ— ν˜ΈμŠ€νŒ…λ  λ•Œ, 검색 엔진 ν¬λ‘€λŸ¬μ— μ˜ν•΄ 전체 디렉토리 ꡬ쑰와 파일λͺ…이 μƒ‰μΈλ˜μ–΄ λ―Όκ°ν•œ 정보가 λ…ΈμΆœλ  수 μžˆλŠ” μ·¨μ•½μ μž…λ‹ˆλ‹€.
**Learning:** 디렉토리 λ‚΄μš©μ„ λ‚˜μ—΄ν•˜λŠ” 정적 HTML을 생성할 λ•Œ, λͺ…μ‹œμ μœΌλ‘œ 검색 엔진 크둀링을 λ°©μ§€ν•˜μ§€ μ•ŠμœΌλ©΄ μ˜λ„μΉ˜ μ•Šκ²Œ λ‚΄λΆ€ ꡬ쑰와 파일λͺ…이 ꡬ글 λ“±μ˜ 검색 결과에 λ…ΈμΆœλ  수 μžˆμŠ΅λ‹ˆλ‹€.
**Prevention:** μƒμ„±λ˜λŠ” HTML의 <head> μ˜μ—­μ— 항상 <meta name="robots" content="noindex, nofollow"> νƒœκ·Έλ₯Ό ν¬ν•¨ν•˜μ—¬ 검색 엔진이 ν•΄λ‹Ή νŽ˜μ΄μ§€λ₯Ό μƒ‰μΈν•˜κ±°λ‚˜ 링크λ₯Ό 따라가지 μ•Šλ„λ‘ κ°•μ œν•΄μ•Ό ν•©λ‹ˆλ‹€.
Comment on lines +87 to +90

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ”’ Security & Privacy | 🟠 Major | ⚑ Quick win

robots 메타 νƒœκ·Έμ˜ 보μž₯ λ²”μœ„λ₯Ό μ •ν™•νžˆ κΈ°λ‘ν•˜μ„Έμš”.

noindex, nofollowλŠ” ν•΄λ‹Ή μ§€μ‹œλ₯Ό μ€€μˆ˜ν•˜λŠ” 검색 엔진 ν¬λ‘€λŸ¬μ— λŒ€ν•œ μ•ˆλ‚΄μž…λ‹ˆλ‹€. 이 νƒœκ·ΈλŠ” λ™μž‘μ„ κ°•μ œν•˜μ§€ μ•ŠμœΌλ©°, 직접 μ ‘κ·Ό κ°€λŠ₯ν•œ νŒŒμΌμ΄λ‚˜ λΉ„μ€€μˆ˜ 크둀러λ₯Ό λ³΄ν˜Έν•˜μ§€ μ•ŠμŠ΅λ‹ˆλ‹€. μ„œλ²„ μΈ‘ 인증 λ˜λŠ” μ ‘κ·Ό μ œμ–΄λ„ λŒ€μ²΄ν•˜μ§€ μ•ŠμŠ΅λ‹ˆλ‹€.

μ˜ˆλ°©μ±…μ— β€œμ€€μˆ˜ν•˜λŠ” 크둀러의 색인과 링크 좔적을 쀄인닀”고 λͺ…μ‹œν•˜κ³ , λ―Όκ°ν•œ μ½˜ν…μΈ μ—λŠ” λ³„λ„μ˜ μ„œλ²„ μΈ‘ μ ‘κ·Ό μ œμ–΄κ°€ ν•„μš”ν•˜λ‹€κ³  κΈ°λ‘ν•˜μ„Έμš”.

πŸ€– Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.jules/sentinel.md around lines 87 - 90, Update the Prevention guidance in
the html4tree vulnerability entry to state that the robots noindex, nofollow tag
only reduces indexing and link following by compliant crawlers; it does not
enforce protection against direct file access or non-compliant crawlers.
Explicitly note that sensitive content requires separate server-side
authentication or access control.

2 changes: 2 additions & 0 deletions src/main/kotlin/html4tree/main.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,6 +330,8 @@ ${cssContent} </style>
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src '${styleHash}'; base-uri 'none'; form-action 'none';">
<!-- λ³΄μ•ˆ ν–₯상: 리퍼러λ₯Ό ν†΅ν•œ 디렉토리 경둜 λ…ΈμΆœ 방지 -->
<meta name="referrer" content="no-referrer">
<!-- λ³΄μ•ˆ ν–₯상: 검색 엔진 인덱싱을 ν†΅ν•œ 정보 λ…ΈμΆœ 방지 -->
<meta name="robots" content="noindex, nofollow">
<title>${curr_dir.getName().escapeHtml()}</title>
${css}
</head>
Expand Down
1 change: 1 addition & 0 deletions src/test/kotlin/html4tree/MainTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,7 @@ class MainTest {
val htmlContent = indexFile.readText()
assertTrue(htmlContent.contains("<html lang=\"ko\">"))
assertTrue(htmlContent.contains("<meta name=\"color-scheme\" content=\"light dark\">"))
assertTrue(htmlContent.contains("<meta name=\"robots\" content=\"noindex, nofollow\">"))
assertTrue(htmlContent.contains("<nav aria-label=\"디렉토리 λͺ©λ‘\">"))
assertTrue(htmlContent.contains("role=\"list\""))
assertTrue(htmlContent.contains("<main>"))
Expand Down
Loading