ContextualWisdomLab · seonghobae · Jul 23, 2026
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
@@ -38,3 +38,7 @@
 **Vulnerability:** Missing input validation on `setLanguage()` could allow invalid strings (like Prototype Pollution payloads or arbitrary text) to be applied to the DOM (`lang` attribute) and stored in `localStorage`.
 **Learning:** The global `setLanguage` function assumed inputs would only come from predefined button clicks, skipping runtime validation.
 **Prevention:** Always sanitize and validate function arguments at the application boundary, even if the primary caller is trusted, to enforce defense in depth.
+## 2026-07-23 - Strict base-uri in Content Security Policy
+**Vulnerability:** The Content Security Policy in `index.html` used `base-uri 'self'`, which is less restrictive than necessary since the application does not rely on base tags.
+**Learning:** Even a `'self'` restriction on `base-uri` can be risky if there are other vulnerabilities (like an open redirect or path traversal) on the same origin. Since the static site uses absolute paths relative to the root or relative paths without needing a base tag change, `base-uri 'none'` is the safest default.
+**Prevention:** Always default to `base-uri 'none'` in the Content Security Policy for applications that do not explicitly require the `<base>` HTML element.
diff --git a/index.html b/index.html
@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self'; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests; require-trusted-types-for 'script';">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests; require-trusted-types-for 'script';">
     <meta name="referrer" content="strict-origin-when-cross-origin">
     <title>맥락지혜 연구실 | Contextual Wisdom Lab</title>
     <meta

diff --git a/tests/test_index_security.py b/tests/test_index_security.py
@@ -0,0 +1,18 @@
+"""Security regression tests for the main index.html."""
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+INDEX = ROOT / "index.html"
+
+def test_index_declares_strict_base_uri() -> None:
+    """The main index.html restricts base-uri to 'none'."""
+    html = INDEX.read_text(encoding="utf-8")
+    match = re.search(
+        r'<meta\s+http-equiv="Content-Security-Policy"\s+content="([^"]+)"',
+        html,
+    )
+    assert match is not None, "index.html must declare a CSP meta policy"
+    policy = match.group(1)
+    assert "base-uri 'none'" in policy