From b4eaee043436373f3faf1c1dd64c0e8095caf966 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 30 Jun 2026 20:56:28 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL]?=
 =?UTF-8?q?=20=EB=84=90=20=EB=B0=94=EC=9D=B4=ED=8A=B8(Null=20Byte)=20?=
 =?UTF-8?q?=EC=9D=B8=EC=A0=9D=EC=85=98=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?=
 =?UTF-8?q?=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 심각도: CRITICAL
💡 취약점: 파일 업로드 시 파일명 검증 과정에서 널 바이트(`\u0000`) 인젝션 검증 누락
🎯 영향: 악의적인 사용자가 널 바이트를 포함한 파일명(예: `malware.hwp\u0000.pdf`)을 업로드하여 확장자 차단 우회 및 절삭 우회 공격(Truncation bypass)을 시도할 수 있음.
🔧 수정 사항: `DefaultDocumentValidationService`에서 `MultipartFile`의 원본 파일명에 널 바이트가 포함된 경우 `IllegalArgumentException`을 던져 거부하도록 변경함. `.jules/sentinel.md`에 보안 관련 내용을 기록함.
✅ 검증: 널 바이트가 포함된 파일명에 대해 예외가 발생하는지 확인하는 단위 테스트(`rejectsFilenameWithNullByte`)를 추가 및 통과 확인함.
---
 .jules/sentinel.md                             | Bin 685 -> 1511 bytes
 .../DefaultDocumentValidationService.java      |   4 ++++
 .../DefaultDocumentValidationServiceTest.java  |  16 ++++++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 76a9742572c7e5ef7c5abc5be4545bfde07e08d9..274df498615381a15c09110665d197c3f0409891 100644
GIT binary patch
literal 1511
zcmZ`(OK;ma5Y9QjVt^d#1hx=#fgW<p_JPeJ-4;z!>`^o|vZkg<fe*XxukSaM?R2;8
z#gIj6zWE+A7Z>#M`sJ&|^{d4n*R-IIk+<wKz4`Edu{4Q0`uE|1#M5Wt9Y^~6;r#0A
zb8()dS&Eaqzqz`iC!b?U8MjB1heUl08@l~?N0HMQeBwm-n5mP<HoHBUlw{>`KL=_}
zGequNGQOjtkbrBYk7mOytyrP51V5+UAa)?*T-YVzuWXCHr_j^JII$8+qNh)HiJYvN
z+An5nl8rLvo0dYPwlmq>v<(>Cvx#2(N}GQR!YGX&vklVWEzmts|9X6X-_D<#PMouz
zK7G1hRD_fx{wE~?y~t$zUzV(FB@dxw8e_=821i>o2zYH*AXey##WmG-3q?Xq4LuGF
z`SvcDj;!&t<O4@2QrpY8;KZ*<5?SzF;{deu^`w>_=;z!i$AguCRF-#}(eXyDMd?=3
zgX#Gxx)%6Rda+Y)eet$72}<l!foEF&L<0ayx_a0SIgbZr^)cajR#Mf^^G;=&UAC9t
z(FfF-EZ5U=N{jfh<X`DG892p4olDWexATkNr1hWT9R0b^On3eZ^qgd-cjDM1Md??W
zRk_VLLdS{v&VXA<md7kh2i}3amR)LDIhCEYXW)c{_Q&GX6^#MR%8*Q<pUrOQ7O~3N
zz^q6%6o(NBxR(Vn-lO;kU8=@Q7pkMrW$eIqO*3v*&78`p&Q@_xVQ+@rc-D+v-(Jqi
z@pO#7F^vAe>Hsjckp3V2*NUJu;gE*D<F6n3*^9Fmmn|g(7~R$ss!F1B%N{rFF_6Yq
zwebC>xGbZIxynLS^rP`dHU1-!3oEg66}b)_B@A=KHo=}SYtKnnMr3Dnr{L0Y(g2|g
zqLaSIKJnVpa!*~@dE8)AmrgnkMHuVm0B+i2Ic<I(id(lc`*idRdB6sWtO+_H+TgPh
z-4$eh2t*yo0rxSGll9S8M^n*Ep~orPbBuJ%Vv92o&8p7N!BM!nFdKS14O{&PI}bxK
l^?^dzegndjfkw%A$?|OyWjyR^*dQImFphM?{cL}8{vD<P9?<{*

delta 7
OcmaFPy_R*uS|$JudjkXj

diff --git a/src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java b/src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java
index b898f7a..ee027c5 100644
--- a/src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java
+++ b/src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java
@@ -55,6 +55,10 @@ public void validateOrThrow(MultipartFile file, PolicyOverrideRequest overrideRe
         }
 
         String fileName = file.getOriginalFilename();
+        if (fileName != null && fileName.indexOf('\u0000') != -1) {
+            throw new IllegalArgumentException(
+                    "Invalid filename containing null byte.");
+        }
         String extension = extensionOf(fileName);
         if (extension.isEmpty()) {
             throw new IllegalArgumentException("File extension is required.");
diff --git a/src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java b/src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java
index dc1df79..2333ad7 100644
--- a/src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java
+++ b/src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java
@@ -205,6 +205,22 @@ void rejectsBlankFilenameOrMissingName() {
         );
     }
 
+    @Test
+    void rejectsFilenameWithNullByte() {
+        ConversionProperties conversionProperties = new ConversionProperties();
+        conversionProperties.setBlockedExtensions(Set.of("hwp", "hwpx"));
+        DefaultDocumentValidationService validationService = new DefaultDocumentValidationService(conversionProperties);
+
+        IllegalArgumentException ex = assertThrows(
+                IllegalArgumentException.class,
+                () -> validationService.validateOrThrow(
+                        new MockMultipartFile("file", "contract\u0000.pdf", "application/octet-stream", new byte[] {1})
+                )
+        );
+
+        assertEquals("Invalid filename containing null byte.", ex.getMessage());
+    }
+
     @Test
     void rejectsNullFilename() {
         ConversionProperties conversionProperties = new ConversionProperties();