🛡️ Sentinel: [security improvement] CSP base-uri 제한 강화

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: 명시적인 <base> 태그가 불필요한 정적 사이트에서 CSP에 base-uri 'self'가 설정되어 있어, 악의적인 베이스 태그 인젝션 공격을 통한 DOM 기반 XSS나 경로 조작 공격의 여지가 존재했습니다.
🎯 Impact: 취약점 노출 시, 사용자의 세션 탈취 및 사이트 내 악성 스크립트 실행이 가능할 수 있습니다.
🔧 Fix: index.html 파일의 Content Security Policy(CSP) 설정에서 base-uri 'self'를 base-uri 'none'으로 변경하여 베이스 태그 인젝션 공격을 원천 차단했습니다.
✅ Verification: 테스트 스위트가 모두 통과하는 것을 확인하였고 프론트엔드 검증을 통해 CSP 메타 태그가 올바르게 적용됨을 확인했습니다.

---

PR created automatically by Jules for task 4553777671447210037 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR tightens the site’s CSP for the static GitHub Pages homepage by forbidding <base> tag usage, reducing the risk of base-tag injection leading to DOM-based XSS or URL/path manipulation.

Changes:

• Update index.html CSP from base-uri 'self' to base-uri 'none'.
• Document the security hardening in CHANGELOG.md.
• Add a Sentinel security journal entry describing the base-uri injection prevention rationale.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
index.html	Tightens CSP by setting base-uri 'none' to prevent <base>-based injection/rewrites.
CHANGELOG.md	Records the CSP base-uri hardening under [Unreleased].
.jules/sentinel.md	Adds a security learning/prevention entry for base-uri injection mitigation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seonghobae]

Closing as already implemented on main. The current page uses a stronger deny-by-default CSP with base-uri 'none', explicit same-origin resource directives, blocked forms/frames/objects, and regression tests that reject unsafe inline/eval content. This branch is superseded.

[google-labs-jules]

Closing as already implemented on main. The current page uses a stronger deny-by-default CSP with base-uri 'none', explicit same-origin resource directives, blocked forms/frames/objects, and regression tests that reject unsafe inline/eval content. This branch is superseded.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.