From 0b205a7171d1c53ec7015bc942cf8804bbdca02c Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:10:37 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20=EC=A0=95?=
 =?UTF-8?q?=EC=A0=81=20HTML=20=EC=83=9D=EC=84=B1=EA=B8=B0=EB=A5=BC=20?=
 =?UTF-8?q?=EC=9C=84=ED=95=9C=20CSP=20=EB=B3=B4=EC=95=88=20=EA=B0=95?=
 =?UTF-8?q?=ED=99=94=20(Nonce=20=EB=8F=84=EC=9E=85)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `unsafe-inline`을 제거하고 무작위 Nonce(난스)를 사용한 강력한 스타일 CSP 적용
- 기존 인라인 스타일을 CSS 클래스 `.item-link` 및 `.empty-msg`로 분리
- HTML 템플릿의 XSS 방어 계층(Defense in Depth) 강화
- 관련 `MainTest.kt` 테스트 코드 업데이트 완료
---
 .jules/sentinel.md                    |  1 +
 src/main/kotlin/html4tree/main.kt     | 26 +++++++++++++++++++++-----
 src/test/kotlin/html4tree/MainTest.kt |  3 ++-
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 6c61284..edf0698 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -22,3 +22,4 @@
 **Vulnerability:** Defense in Depth (CSP Missing)
 **Learning:** Even when inputs are properly escaped, statically generated HTML that displays file/directory structures should implement a Content Security Policy (CSP) to provide an extra layer of defense against potential XSS bypasses.
 **Prevention:** Include a strict CSP meta tag (e.g., `default-src 'none'; style-src 'unsafe-inline';`) in auto-generated HTML headers when external scripts or resources are not required.
+## 2024-06-29 - [html4tree] Strict CSP Nonce Implementation\n**Vulnerability:** Weak Content Security Policy (CSP)\n**Learning:** The previous CSP allowed `style-src 'unsafe-inline'`, which is generally discouraged as it can weaken defense-in-depth against XSS attacks. The html4tree output relied on `style="..."` attributes.\n**Prevention:** A secure random `nonce` is now generated per execution using `java.security.SecureRandom` and applied to the `<style>` block. Inline styles were refactored into CSS classes (`.item-link`, `.empty-msg`) to eliminate the need for `unsafe-inline`.
diff --git a/src/main/kotlin/html4tree/main.kt b/src/main/kotlin/html4tree/main.kt
index 2e2809f..596d63d 100644
--- a/src/main/kotlin/html4tree/main.kt
+++ b/src/main/kotlin/html4tree/main.kt
@@ -1,6 +1,9 @@
+
 package html4tree
 
 import java.io.File
+import java.security.SecureRandom
+import java.util.Base64
 import java.nio.file.Files
 import java.nio.file.LinkOption
 import java.nio.file.StandardCopyOption
@@ -132,8 +135,12 @@ fun process_dir(curr_dir: File){
     
     val exclude: Set<String> = process_ignore_file(curr_dir)
 
+    val nonceBytes = ByteArray(16)
+    SecureRandom().nextBytes(nonceBytes)
+    val nonce = Base64.getEncoder().encodeToString(nonceBytes)
+
     val css = """
-              <style>
+              <style nonce="${nonce}">
               ul {
                 list-style-type: none;
                 padding-left: 0;
@@ -150,6 +157,15 @@ fun process_dir(curr_dir: File){
                 outline: 2px solid #0366d6;
                 outline-offset: -2px;
               }
+              .item-link {
+                display: block;
+                width: 100%;
+              }
+              .empty-msg {
+                padding: 0.5rem;
+                color: #666;
+                font-style: italic;
+              }
               </style>
               """
 
@@ -159,7 +175,7 @@ fun process_dir(curr_dir: File){
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         <!-- 보안 향상: 인라인 스크립트 실행 방지 -->
-        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline';">
+        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'nonce-${nonce}';">
         <title>${curr_dir.getName().escapeHtml()}</title>
         ${css}
      </head>
@@ -168,7 +184,7 @@ fun process_dir(curr_dir: File){
          <h1>${curr_dir.getName().escapeHtml()}</h1>
          <nav aria-label="Directory listing">
          <ul>
-            <li><a style="display:block; width:100%" href="./.." aria-label="상위 디렉토리로 이동"><span aria-hidden="true">&#x21B0;</span> ..</a></li>
+            <li><a class="item-link" href="./.." aria-label="상위 디렉토리로 이동"><span aria-hidden="true">&#x21B0;</span> ..</a></li>
 """ 
 
     val index_middle = fun():String{ 
@@ -183,13 +199,13 @@ fun process_dir(curr_dir: File){
               val encodedHref = if (isLinkedDirectory) { "./${fileName.urlEncodePath()}/" } else { "./${fileName.urlEncodePath()}" }
               val ariaLabel = "${fileName} ${if (isLinkedDirectory) { "디렉토리" } else { "파일" }}".escapeHtml()
               val icon = if (isLinkedDirectory) { "&#128193;" } else { "&rtrif;" }
-              l.append("""          <li><a style="display:block; width:100%" href="${encodedHref}" aria-label="${ariaLabel}"><span aria-hidden="true">${icon}</span> ${fileName.escapeHtml()}</a></li>""")
+              l.append("""          <li><a class="item-link" href="${encodedHref}" aria-label="${ariaLabel}"><span aria-hidden="true">${icon}</span> ${fileName.escapeHtml()}</a></li>""")
               l.append('\n')
            }
         }
 
         if(l.isEmpty()){
-            l.append("""          <li><div style="padding: 0.5rem; color: #666; font-style: italic;">이 디렉토리는 비어 있습니다.</div></li>""")
+            l.append("""          <li><div class="empty-msg">이 디렉토리는 비어 있습니다.</div></li>""")
             l.append('\n')
         }
 
diff --git a/src/test/kotlin/html4tree/MainTest.kt b/src/test/kotlin/html4tree/MainTest.kt
index e8a3082..2c9f9d5 100644
--- a/src/test/kotlin/html4tree/MainTest.kt
+++ b/src/test/kotlin/html4tree/MainTest.kt
@@ -159,7 +159,8 @@ class MainTest {
         assertTrue(htmlContent.contains("&#128193;"))
         assertFalse(htmlContent.contains("test.ignore"))
         assertTrue(htmlContent.contains("Content-Security-Policy"))
-        assertTrue(htmlContent.contains("default-src 'none'; style-src 'unsafe-inline';"))
+        assertTrue(htmlContent.contains("default-src 'none'; style-src 'nonce-"))
+        assertTrue(htmlContent.contains("class=\"item-link\""))
     }
 
     @Test