🛡️ Sentinel: [CRITICAL] 디렉토리 탐색 시 심볼릭 링크 우회 취약점 수정

.jules/sentinel.md

@@ -22,3 +22,8 @@
 **Vulnerability:** Defense in Depth (CSP Missing)
 **Learning:** Even when inputs are properly escaped, statically generated HTML that displays file/directory structures should implement a Content Security Policy (CSP) to provide an extra layer of defense against potential XSS bypasses.
 **Prevention:** Include a strict CSP meta tag (e.g., `default-src 'none'; style-src 'unsafe-inline';`) in auto-generated HTML headers when external scripts or resources are not required.
+
+## 2024-07-06 - [html4tree] Directory Traversal Bypass via Canonical File
+**Vulnerability:** Path traversal and directory boundary escape through top-level symbolic links.
+**Learning:** Using `File.canonicalFile` resolves symbolic links to their absolute target paths before any subsequent checks are performed. This renders `Files.isDirectory(path, LinkOption.NOFOLLOW_LINKS)` useless because the path passed to it has already had all symlinks resolved by `canonicalFile`, meaning it will appear as a normal directory and bypass symlink checks.
+**Prevention:** When you need an absolute path but must preserve symbolic links for validation purposes, use `.toPath().toAbsolutePath().normalize().toFile()` instead of `.canonicalFile`. This normalizes `.` and `..` without resolving symbolic links, allowing `LinkOption.NOFOLLOW_LINKS` checks to function correctly.

CHANGELOG.md

@@ -0,0 +1,5 @@
+# 변경 사항
+
+## [Unreleased]
+### 보안 (Security)
+- `canonicalFile` 대신 `normalize()`를 사용하여 `html4tree`의 심볼릭 링크 기반 디렉토리 탐색 우회 취약점을 수정했습니다. `canonicalFile`은 사전에 심볼릭 링크를 대상 경로로 해석하여 이어지는 `LinkOption.NOFOLLOW_LINKS` 검사를 무력화하는 문제가 있었습니다.

src/main/kotlin/html4tree/main.kt

@@ -23,7 +23,7 @@ fun main(args: Array<String>)  = Html4tree().main(args)
 
 fun go(topDir: String, maxLevel: Int)  {
     require(topDir.isNotBlank())
-    val top_dir = File(topDir).canonicalFile
+    val top_dir = File(topDir).toPath().toAbsolutePath().normalize().toFile()
     require(Files.isDirectory(top_dir.toPath(), LinkOption.NOFOLLOW_LINKS)) { "Top directory must be an existing non-symlink directory" }
 
     val ll = LinkedList()