🛡️ Sentinel: [HIGH] 최상위 디렉토리 심볼릭 링크 우회 취약점 수정

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: File.canonicalFile이 심볼릭 링크를 미리 해석하여, Files.isDirectory의 NOFOLLOW_LINKS 옵션을 우회하고 의도치 않은 시스템 경로의 파일을 읽을 수 있는 경로 탐색(Path Traversal) 취약점이 발생할 수 있었습니다.
🎯 Impact: 공격자가 샌드박스를 우회하고 시스템의 임의 디렉토리 구조를 읽어 정보 유출 등의 피해가 발생할 수 있습니다.
🔧 Fix: canonicalFile 대신 toPath().toAbsolutePath().normalize().toFile()를 사용하여 심볼릭 링크를 해석하지 않은 상태의 절대 경로를 가져오도록 수정했습니다. 이로써 Files.isDirectory 함수가 심볼릭 링크를 정상적으로 차단할 수 있게 되었습니다.
✅ Verification: testGoRejectsSymlinkTopDir 테스트 케이스가 성공적으로 통과하며 100% 코드 커버리지를 검증했습니다.

---

PR created automatically by Jules for task 8396158036172354303 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[seonghobae]

Closing as superseded during org-wide PR triage. Keeping #108 as the canonical PR for the same overlapping topic: symlink/path traversal hardening. This PR is stale/conflicted or has review blockers, so retaining one current PR reduces duplicated review and merge conflict work.

[google-labs-jules]

Closing as superseded during org-wide PR triage. Keeping #108 as the canonical PR for the same overlapping topic: symlink/path traversal hardening. This PR is stale/conflicted or has review blockers, so retaining one current PR reduces duplicated review and merge conflict work.

Understood. Acknowledging that this work is superseded by #108 and stopping work on this task.