From 98204052e1a6f7828b3788b3d463e58220772bc9 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 21 Jul 2026 14:07:53 +0000 Subject: [PATCH] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=EA=B0=9C=EC=84=A0:=20?= =?UTF-8?q?=EB=A9=94=EC=9D=B8=20=ED=8E=98=EC=9D=B4=EC=A7=80=20CSP=20?= =?UTF-8?q?=EA=B0=95=ED=99=94=20=EB=B0=8F=20=EA=B2=80=EC=A6=9D=20=ED=85=8C?= =?UTF-8?q?=EC=8A=A4=ED=8A=B8=20=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 메인 페이지(`index.html`)의 Content-Security-Policy를 `default-src 'none'` 기반의 엄격한 화이트리스트 방식으로 강화하여 잠재적인 공격 표면을 최소화했습니다. 이를 검증하는 `test_index_security.py` 회귀 테스트를 추가했습니다. --- .jules/sentinel.md | 5 +++ CHANGELOG.md | 1 + index.html | 2 +- tests/test_index_security.py | 62 ++++++++++++++++++++++++++++++++++++ 4 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 tests/test_index_security.py diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 4f173bc..16b6673 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -38,3 +38,8 @@ **Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`. **Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation. **Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth. + +## 2025-02-12 - [Strict CSP on Main Page] +**Vulnerability:** The main `index.html` used a permissive `default-src 'self'` CSP and `base-uri 'self'`, which is weaker than a strict deny-by-default approach. +**Learning:** Even static HTML sites should use a strict deny-by-default CSP (`default-src 'none'`) and explicitly allow only necessary asset types (`script-src`, `style-src`, etc.) to minimize attack surface in case of future changes or vulnerabilities. `base-uri 'none'` and `object-src 'none'` are also crucial. +**Prevention:** Always default to a strict `default-src 'none'` CSP for all HTML entry points, explicitly declaring necessary sources. diff --git a/CHANGELOG.md b/CHANGELOG.md index 56ad628..74f5eb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,3 +12,4 @@ - **보안 개선**: `i18n.js`의 `setLanguage()` 함수에 허용된 언어인지 확인하는 입력값 검증(Input Validation) 로직을 추가하여 Prototype Pollution 및 유효하지 않은 상태 주입을 방지했습니다. - **성능 개선**: `i18n.js`에서 초기 로드 시 기본 언어가 한국어(ko)인 경우 불필요한 DOM 순회 및 텍스트 업데이트를 생략하도록 개선했습니다. - **테스트 추가**: 다국어 처리 로직의 무결성을 검증하기 위해 `test_i18n.html` 테스트 파일을 추가했습니다. +- **보안 개선**: 메인 페이지(`index.html`)의 Content-Security-Policy를 `default-src 'none'` 기반의 엄격한 화이트리스트 방식으로 강화하여 잠재적인 공격 표면을 최소화했습니다. diff --git a/index.html b/index.html index c40fea3..fd888db 100644 --- a/index.html +++ b/index.html @@ -3,7 +3,7 @@ - + 맥락지혜 연구실 | Contextual Wisdom Lab str: + """Return the main index.html source.""" + return INDEX.read_text(encoding="utf-8") + + +def _csp_content(html: str) -> str: + """Extract the CSP meta policy from the HTML.""" + match = re.search( + r' None: + """The main page limits active content using a strict deny-by-default CSP.""" + policy = _csp_content(_index_html()) + + for directive in ( + "default-src 'none'", + "script-src 'self'", + "img-src 'self'", + "font-src 'self'", + "connect-src 'self'", + "object-src 'none'", + "base-uri 'none'", + "form-action 'none'", + "frame-src 'none'", + "upgrade-insecure-requests", + "require-trusted-types-for 'script'", + "style-src 'self'", + ): + assert directive in policy + assert "'unsafe-inline'" not in policy + assert "'unsafe-eval'" not in policy + +def test_index_has_no_inline_active_content() -> None: + """Strict CSP remains enforceable without inline script or style exceptions.""" + html = _index_html() + + assert re.search(r")", html, flags=re.IGNORECASE) is None + assert re.search(r"\sstyle\s*=", html, flags=re.IGNORECASE) is None + assert re.search( + r"]*\bsrc=)[^>]*>", html, flags=re.IGNORECASE + ) is None + assert re.search(r"\son[a-z]+\s*=", html, flags=re.IGNORECASE) is None + assert 'href="styles.css"' in html + assert 'src="i18n.js"' in html + assert ( + '' in html + )