🛡️ Sentinel: [보안 개선] base-uri CSP 강화 (base-uri 'none')

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: index.html의 CSP 설정에서 base-uri가 'self'로 설정되어 있어 불필요하게 넓은 권한이 부여되었습니다. 이 앱은 <base> 태그를 사용하지 않습니다.
🎯 Impact: <base> 태그 삽입 취약점을 통한 경로 및 URL 하이재킹 위험이 존재했습니다.
🔧 Fix: CSP의 base-uri 지시어를 'none'으로 변경하고, 관련 검증 테스트를 추가했습니다.
✅ Verification:

python3 -m pytest tests/

명령을 통해 모든 테스트가 통과하는지 확인할 수 있습니다.

---

PR created automatically by Jules for task 2539522658319416106 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Tightens the static site’s CSP in index.html by locking down base-uri to prevent <base>-tag injection–based URL/path hijacking, and adds a regression test to ensure the policy stays strict over time.

Changes:

• Update index.html CSP from base-uri 'self' to base-uri 'none'.
• Add a pytest regression test asserting the main page declares a strict base-uri.
• Document the security learning/prevention note in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
index.html	Tightens CSP by setting base-uri 'none' for stronger default hardening.
tests/test_index_security.py	Adds a regression test to detect CSP regressions for base-uri.
.jules/sentinel.md	Records the security rationale and prevention guidance for future changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seonghobae]

Closing as already implemented on main. The current page uses a stronger deny-by-default CSP with base-uri 'none', explicit same-origin resource directives, blocked forms/frames/objects, and regression tests that reject unsafe inline/eval content. This branch is superseded.

[google-labs-jules]

Closing as already implemented on main. The current page uses a stronger deny-by-default CSP with base-uri 'none', explicit same-origin resource directives, blocked forms/frames/objects, and regression tests that reject unsafe inline/eval content. This branch is superseded.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.