🛡️ Sentinel: [HIGH] 파일 업로드 시 널 바이트 삽입 취약점 수정

.jules/sentinel.md

@@ -1,4 +1,4 @@
-## 2026-06-30 - Prevent DOM-based XSS in Viewer JS
-**Vulnerability:** Untrusted paths from API responses were directly assigned to `a.href` and used in `iframe` generation, which allows execution of malicious URIs like `javascript:` or `data:`.
-**Learning:** Even when avoiding `innerHTML`, directly setting URL-like strings to DOM attributes without protocol validation introduces XSS vectors. The payload can be executed when the link is clicked or the iframe is loaded.
-**Prevention:** Implement an `isSafeUrl` verification function to ensure the protocol is strictly `http:` or `https:` (using `new URL()`) before assigning untrusted inputs to DOM attributes like `href` or `src`.
+## 2026-07-01 - [Null Byte Injection Prevention]
+**Vulnerability:** Filename inputs missing sanitization for null bytes could be truncated, bypassing extension validation rules.
+**Learning:** Checking the `file.getOriginalFilename()` for null bytes (`\u0000`) before proceeding ensures that files with hidden payloads or manipulated extensions are rejected explicitly.
+**Prevention:** Always validate and reject file names that contain null bytes (`\u0000`) at the very beginning of processing, throwing an `IllegalArgumentException` rather than ignoring them.

src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java

@@ -55,6 +55,9 @@ public void validateOrThrow(MultipartFile file, PolicyOverrideRequest overrideRe
         }
 
         String fileName = file.getOriginalFilename();
+        if (fileName != null && fileName.indexOf('\u0000') != -1) {
+            throw new IllegalArgumentException("File name contains invalid characters.");
+        }
         String extension = extensionOf(fileName);
         if (extension.isEmpty()) {
             throw new IllegalArgumentException("File extension is required.");

src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java

@@ -191,6 +191,22 @@ void rejectsMissingExtension() {
         assertEquals("File extension is required.", ex.getMessage());
     }
 
+    @Test
+    void rejectsFilenameWithNullByte() {
+        ConversionProperties conversionProperties = new ConversionProperties();
+        conversionProperties.setBlockedExtensions(Set.of("hwp", "hwpx"));
+        DefaultDocumentValidationService validationService = new DefaultDocumentValidationService(conversionProperties);
+
+        IllegalArgumentException ex = assertThrows(
+                IllegalArgumentException.class,
+                () -> validationService.validateOrThrow(
+                        new MockMultipartFile("file", "contract\u0000.pdf", "application/pdf", new byte[] {1})
+                )
+        );
+
+        assertEquals("File name contains invalid characters.", ex.getMessage());
+    }
+
     @Test
     void rejectsBlankFilenameOrMissingName() {
         ConversionProperties conversionProperties = new ConversionProperties();