ContextualWisdomLab · seonghobae · Jul 21, 2026
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
@@ -38,3 +38,8 @@
 **Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`.
 **Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation.
 **Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth.
+
+## 2025-02-12 - [Strict CSP on Main Page]
+**Vulnerability:** The main `index.html` used a permissive `default-src 'self'` CSP and `base-uri 'self'`, which is weaker than a strict deny-by-default approach.
+**Learning:** Even static HTML sites should use a strict deny-by-default CSP (`default-src 'none'`) and explicitly allow only necessary asset types (`script-src`, `style-src`, etc.) to minimize attack surface in case of future changes or vulnerabilities. `base-uri 'none'` and `object-src 'none'` are also crucial.
+**Prevention:** Always default to a strict `default-src 'none'` CSP for all HTML entry points, explicitly declaring necessary sources.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,3 +12,4 @@
 - **보안 개선**: `i18n.js`의 `setLanguage()` 함수에 허용된 언어인지 확인하는 입력값 검증(Input Validation) 로직을 추가하여 Prototype Pollution 및 유효하지 않은 상태 주입을 방지했습니다.
 - **성능 개선**: `i18n.js`에서 초기 로드 시 기본 언어가 한국어(ko)인 경우 불필요한 DOM 순회 및 텍스트 업데이트를 생략하도록 개선했습니다.
 - **테스트 추가**: 다국어 처리 로직의 무결성을 검증하기 위해 `test_i18n.html` 테스트 파일을 추가했습니다.
+- **보안 개선**: 메인 페이지(`index.html`)의 Content-Security-Policy를 `default-src 'none'` 기반의 엄격한 화이트리스트 방식으로 강화하여 잠재적인 공격 표면을 최소화했습니다.
diff --git a/index.html b/index.html
@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self'; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests; require-trusted-types-for 'script';">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-src 'none'; upgrade-insecure-requests; require-trusted-types-for 'script';">
     <meta name="referrer" content="strict-origin-when-cross-origin">
     <title>맥락지혜 연구실 | Contextual Wisdom Lab</title>
     <meta

diff --git a/tests/test_index_security.py b/tests/test_index_security.py
@@ -0,0 +1,62 @@
+"""Security regression tests for the main page (index.html)."""
+
+import re
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+INDEX = ROOT / "index.html"
+
+
+def _index_html() -> str:
+    """Return the main index.html source."""
+    return INDEX.read_text(encoding="utf-8")
+
+
+def _csp_content(html: str) -> str:
+    """Extract the CSP meta policy from the HTML."""
+    match = re.search(
+        r'<meta\s+http-equiv="Content-Security-Policy"\s+content="([^"]+)"',
+        html,
+    )
+    assert match is not None, "index.html must declare a CSP meta policy"
+    return match.group(1)
+
+
+def test_index_declares_strict_csp() -> None:
+    """The main page limits active content using a strict deny-by-default CSP."""
+    policy = _csp_content(_index_html())
+
+    for directive in (
+        "default-src 'none'",
+        "script-src 'self'",
+        "img-src 'self'",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "object-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-src 'none'",
+        "upgrade-insecure-requests",
+        "require-trusted-types-for 'script'",
+        "style-src 'self'",
+    ):
+        assert directive in policy
+    assert "'unsafe-inline'" not in policy
+    assert "'unsafe-eval'" not in policy
+
+def test_index_has_no_inline_active_content() -> None:
+    """Strict CSP remains enforceable without inline script or style exceptions."""
+    html = _index_html()
+
+    assert re.search(r"<style(?:\s|>)", html, flags=re.IGNORECASE) is None
+    assert re.search(r"\sstyle\s*=", html, flags=re.IGNORECASE) is None
+    assert re.search(
+        r"<script(?![^>]*\bsrc=)[^>]*>", html, flags=re.IGNORECASE
+    ) is None
+    assert re.search(r"\son[a-z]+\s*=", html, flags=re.IGNORECASE) is None
+    assert 'href="styles.css"' in html
+    assert 'src="i18n.js"' in html
+    assert (
+        '<meta name="referrer" content="strict-origin-when-cross-origin">' in html
+    )