From 59469e0923eeaf686e5a8b3d4668fb7f73585e9e Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Mon, 29 Jun 2026 10:20:42 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[=EB=B3=B4?=
 =?UTF-8?q?=EC=95=88=20=EA=B0=9C=EC=84=A0]=20YouTube=20URL=20=EC=9E=85?=
 =?UTF-8?q?=EB=A0=A5=EC=97=90=20=EC=B5=9C=EB=8C=80=20=EA=B8=B8=EC=9D=B4=20?=
 =?UTF-8?q?=EC=A0=9C=ED=95=9C=20=EC=B6=94=EA=B0=80=20(DoS=20=EB=B0=A9?=
 =?UTF-8?q?=EC=A7=80)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`<Input>` 컴포넌트의 YouTube URL 입력란에 `maxLength={2048}` 속성을 추가하여, 사용자가 의도치 않게 매우 긴 문자열을 붙여넣어 발생할 수 있는 메모리 고갈 및 UI 성능 저하(Denial of Service) 위험을 방지합니다.

🚨 심각도: 보안 개선 (Enhancement)
💡 취약점: UI 계층의 입력 길이 제한 부재 (잠재적 DoS)
🎯 영향: 매우 긴 문자열 입력 시 클라이언트 리소스 고갈
🔧 수정: `<Input>` 에 `maxLength` 속성 추가 및 관련 테스트(`App.test.tsx`) 작성
✅ 검증: 100% 테스트 커버리지 달성, 모든 워크스페이스 테스트 및 `quickcheck.sh` 통과 완료
---
 .jules/sentinel.md            | 4 ++++
 apps/desktop/src/App.test.tsx | 6 ++++++
 apps/desktop/src/App.tsx      | 1 +
 3 files changed, 11 insertions(+)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index c7a67127..1e80d3de 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,7 @@
 **Vulnerability:** CSV formula injection mitigation was naive, missing leading whitespace, tabs, and newlines.
 **Learning:** Checking `/^[=+\-@]/` is not sufficient, as OWASP states that spaces and tabs before the formula triggers will also execute the formula in applications like Excel.
 **Prevention:** Use a regex that allows leading whitespace (e.g. `/^[\s\uFEFF\xA0]*[=+\-@\t\r\n]/`) and include standalone tabs or new lines which are also injection vectors.
+## 2026-06-25 - Frontend Input Length Limit (DoS Mitigation)
+**Vulnerability:** The YouTube URL `<Input />` component in the desktop app lacked a `maxLength` attribute, potentially allowing users to paste excessively long strings, leading to UI thread lockups or memory exhaustion (Denial of Service).
+**Learning:** Even client-side inputs communicating with a secure backend should enforce length constraints at the DOM level to prevent resource exhaustion vulnerabilities and performance degradation.
+**Prevention:** Enforce length limits (e.g., `maxLength={2048}`) on all user-facing text `<Input />` components.
diff --git a/apps/desktop/src/App.test.tsx b/apps/desktop/src/App.test.tsx
index 387f6bcb..9847b07a 100644
--- a/apps/desktop/src/App.test.tsx
+++ b/apps/desktop/src/App.test.tsx
@@ -776,6 +776,12 @@ describe("App", () => {
     });
   });
 
+  it("enforces a maximum length on the YouTube URL input", () => {
+    render(<App />);
+    const input = screen.getByPlaceholderText(/YouTube URL.../i);
+    expect(input).toHaveAttribute("maxLength", "2048");
+  });
+
   it("rejects non-http YouTube URL", async () => {
     render(<App />);
     const input = screen.getByPlaceholderText(/YouTube URL.../i);
diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx
index 09f44be4..3df81078 100644
--- a/apps/desktop/src/App.tsx
+++ b/apps/desktop/src/App.tsx
@@ -568,6 +568,7 @@ export function App() {
                     disabled={analysisInFlight || isStarting || isImporting}
                     className="h-10 flex-1 border-0 bg-transparent text-slate-100 placeholder:text-slate-500 focus-visible:ring-cyan-300"
                     aria-label="YouTube URL"
+                    maxLength={2048}
                   />
                   <Button
                     onClick={handleImportYoutube}