🛡️ Sentinel: [HIGH] 파일 업로드 확장자 검증 시 Null-byte 우회 취약점 수정

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-06-26 - [Null Byte Bypass in File Extension Validation]
+**Vulnerability:** File extension validation was vulnerable to null byte injection (e.g. `file.hwp\u0000`).
+**Learning:** `String.strip()` does not remove null characters, leaving them at the end of the extracted extension, bypassing exact match checks in sets (like `blockedExtensions.contains(extension)`).
+**Prevention:** Always explicitly remove or reject null bytes (`\u0000`) before performing file extension extraction or validation, as many string normalization functions only target whitespace.

pom.xml

@@ -89,6 +89,25 @@
           <argLine>@{argLine} -Xshare:off -XX:+EnableDynamicAgentLoading --enable-native-access=ALL-UNNAMED</argLine>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <version>0.8.12</version>
+        <executions>
+          <execution>
+            <goals>
+              <goal>prepare-agent</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>report</id>
+            <phase>test</phase>
+            <goals>
+              <goal>report</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
       <plugin>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-maven-plugin</artifactId>

src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java

@@ -55,6 +55,11 @@ public void validateOrThrow(MultipartFile file, PolicyOverrideRequest overrideRe
         }
 
         String fileName = file.getOriginalFilename();
+        if (fileName != null && fileName.indexOf('\u0000') != -1) {
+            throw new IllegalArgumentException(
+                    "File name contains invalid characters.");
+        }
+
         String extension = extensionOf(fileName);
         if (extension.isEmpty()) {
             throw new IllegalArgumentException("File extension is required.");

src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java

@@ -38,6 +38,38 @@ void rejectsHwpAndHwpxByDefault() {
         assertEquals("hwp", ex.getExtension());
     }
 
+    @Test
+    void rejectsFilenameWithNullByteBypass() {
+        ConversionProperties conversionProperties = new ConversionProperties();
+        conversionProperties.setBlockedExtensions(Set.of("hwp", "hwpx"));
+        DefaultDocumentValidationService validationService = new DefaultDocumentValidationService(conversionProperties);
+
+        IllegalArgumentException ex = assertThrows(
+                IllegalArgumentException.class,
+                () -> validationService.validateOrThrow(
+                        new MockMultipartFile("file", "contract.hwp\u0000", "application/octet-stream", new byte[] {1})
+                )
+        );
+
+        assertEquals("File name contains invalid characters.", ex.getMessage());
+    }
+
+    @Test
+    void rejectsFilenameWithNullByteTruncationAttack() {
+        ConversionProperties conversionProperties = new ConversionProperties();
+        conversionProperties.setBlockedExtensions(Set.of("hwp", "hwpx"));
+        DefaultDocumentValidationService validationService = new DefaultDocumentValidationService(conversionProperties);
+
+        IllegalArgumentException ex = assertThrows(
+                IllegalArgumentException.class,
+                () -> validationService.validateOrThrow(
+                        new MockMultipartFile("file", "malicious.sh\u0000.pdf", "application/pdf", new byte[] {1})
+                )
+        );
+
+        assertEquals("File name contains invalid characters.", ex.getMessage());
+    }
+
     @Test
     void allowsBlockedExtensionWhenOverrideHeadersAreValid() {
         ConversionProperties conversionProperties = new ConversionProperties();