From 0240a131a745c80a8d6c37454eda7a8c2d670045 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 21 Jul 2026 04:08:40 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[ENHANC?=
 =?UTF-8?q?EMENT]=20=EC=9E=85=EB=A0=A5=20=EC=BB=B4=ED=8F=AC=EB=84=8C?=
 =?UTF-8?q?=ED=8A=B8=20=EC=B5=9C=EB=8C=80=20=EA=B8=B8=EC=9D=B4=20=EC=A0=9C?=
 =?UTF-8?q?=ED=95=9C=20=EC=B6=94=EA=B0=80=20(DoS=20=EB=B0=A9=EC=A7=80)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/desktop/src/components/ui/input.tsx |  3 +-
 create_pr.py                             | 56 ++++++++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 create_pr.py

diff --git a/apps/desktop/src/components/ui/input.tsx b/apps/desktop/src/components/ui/input.tsx
index cef9ebe7..b29f11ae 100644
--- a/apps/desktop/src/components/ui/input.tsx
+++ b/apps/desktop/src/components/ui/input.tsx
@@ -4,10 +4,11 @@ import { Input as InputPrimitive } from "@base-ui/react/input"
 import { cn } from "@/lib/utils"
 
 /** Render a styled text input that keeps native input semantics. */
-function Input({ className, type, ...props }: React.ComponentProps<"input">) {
+function Input({ className, type, maxLength = 2048, ...props }: React.ComponentProps<"input">) {
   return (
     <InputPrimitive
       type={type}
+      maxLength={maxLength}
       data-slot="input"
       className={cn(
         "h-8 w-full min-w-0 rounded-lg border border-input bg-transparent px-2.5 py-1 text-base transition-colors outline-none file:inline-flex file:h-6 file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:bg-input/50 disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 md:text-sm dark:bg-input/30 dark:disabled:bg-input/80 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40",
diff --git a/create_pr.py b/create_pr.py
new file mode 100644
index 00000000..543b1c62
--- /dev/null
+++ b/create_pr.py
@@ -0,0 +1,56 @@
+import urllib.request
+import json
+import os
+import subprocess
+
+def get_remote_url():
+    result = subprocess.run(["git", "remote", "get-url", "origin"], capture_output=True, text=True)
+    return result.stdout.strip()
+
+def main():
+    token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
+    if not token:
+        print("GITHUB_TOKEN or GH_TOKEN not found in environment.")
+        return
+
+    url = get_remote_url()
+
+    # Check if url ends with .git and strip it
+    if url.endswith(".git"):
+        url = url[:-4]
+
+    # Parse owner and repo from URL (https://github.com/owner/repo)
+    parts = url.split("github.com/")
+    if len(parts) != 2:
+        print(f"Could not parse repository from URL: {url}")
+        return
+
+    owner_repo = parts[1]
+
+    api_url = f"https://api.github.com/repos/{owner_repo}/pulls"
+
+    data = {
+        "title": "🛡️ Sentinel: [ENHANCEMENT] 입력 컴포넌트 최대 길이 제한 추가 (DoS 방지)",
+        "head": "feature/add-input-max-length",
+        "base": "develop",
+        "body": "🚨 심각도: ENHANCEMENT\n💡 취약점: 텍스트 입력 필드에 최대 길이 제한이 없어, 매우 긴 문자열이 입력될 경우 클라이언트 측 정규식 평가 등에서 리소스 고갈(DoS) 및 메모리 초과가 발생할 위험이 있습니다.\n🎯 영향: 악의적이거나 비정상적으로 긴 텍스트 입력으로 인해 애플리케이션 성능 저하 및 충돌이 발생할 수 있습니다.\n🔧 해결 방법: `apps/desktop/src/components/ui/input.tsx`의 `<Input>` 컴포넌트에 기본 `maxLength={2048}` 속성을 추가하여 과도한 입력을 차단했습니다.\n✅ 검증 방법: 테스트 스위트를 실행하여 회귀가 없음을 확인합니다."
+    }
+
+    headers = {
+        "Authorization": f"Bearer {token}",
+        "Accept": "application/vnd.github.v3+json",
+        "Content-Type": "application/json"
+    }
+
+    req = urllib.request.Request(api_url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
+    try:
+        with urllib.request.urlopen(req) as response:
+            result = json.loads(response.read().decode("utf-8"))
+            print(f"Pull request created successfully: {result['html_url']}")
+    except urllib.error.HTTPError as e:
+        print(f"Failed to create pull request: {e.code} {e.reason}")
+        error_body = e.read().decode("utf-8")
+        print(error_body)
+
+if __name__ == "__main__":
+    main()

From 3e1ff805ad222b0ebf4b9ca6f0f469e6b23ea95a Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 21 Jul 2026 04:15:04 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[ENHANC?=
 =?UTF-8?q?EMENT]=20=EC=9E=85=EB=A0=A5=20=EC=BB=B4=ED=8F=AC=EB=84=8C?=
 =?UTF-8?q?=ED=8A=B8=20=EC=B5=9C=EB=8C=80=20=EA=B8=B8=EC=9D=B4=20=EC=A0=9C?=
 =?UTF-8?q?=ED=95=9C=20=EC=B6=94=EA=B0=80=20(DoS=20=EB=B0=A9=EC=A7=80)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 create_pr.py      | 56 -----------------------------------------------
 package-lock.json |  6 ++---
 2 files changed, 3 insertions(+), 59 deletions(-)
 delete mode 100644 create_pr.py

diff --git a/create_pr.py b/create_pr.py
deleted file mode 100644
index 543b1c62..00000000
--- a/create_pr.py
+++ /dev/null
@@ -1,56 +0,0 @@
-import urllib.request
-import json
-import os
-import subprocess
-
-def get_remote_url():
-    result = subprocess.run(["git", "remote", "get-url", "origin"], capture_output=True, text=True)
-    return result.stdout.strip()
-
-def main():
-    token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
-    if not token:
-        print("GITHUB_TOKEN or GH_TOKEN not found in environment.")
-        return
-
-    url = get_remote_url()
-
-    # Check if url ends with .git and strip it
-    if url.endswith(".git"):
-        url = url[:-4]
-
-    # Parse owner and repo from URL (https://github.com/owner/repo)
-    parts = url.split("github.com/")
-    if len(parts) != 2:
-        print(f"Could not parse repository from URL: {url}")
-        return
-
-    owner_repo = parts[1]
-
-    api_url = f"https://api.github.com/repos/{owner_repo}/pulls"
-
-    data = {
-        "title": "🛡️ Sentinel: [ENHANCEMENT] 입력 컴포넌트 최대 길이 제한 추가 (DoS 방지)",
-        "head": "feature/add-input-max-length",
-        "base": "develop",
-        "body": "🚨 심각도: ENHANCEMENT\n💡 취약점: 텍스트 입력 필드에 최대 길이 제한이 없어, 매우 긴 문자열이 입력될 경우 클라이언트 측 정규식 평가 등에서 리소스 고갈(DoS) 및 메모리 초과가 발생할 위험이 있습니다.\n🎯 영향: 악의적이거나 비정상적으로 긴 텍스트 입력으로 인해 애플리케이션 성능 저하 및 충돌이 발생할 수 있습니다.\n🔧 해결 방법: `apps/desktop/src/components/ui/input.tsx`의 `<Input>` 컴포넌트에 기본 `maxLength={2048}` 속성을 추가하여 과도한 입력을 차단했습니다.\n✅ 검증 방법: 테스트 스위트를 실행하여 회귀가 없음을 확인합니다."
-    }
-
-    headers = {
-        "Authorization": f"Bearer {token}",
-        "Accept": "application/vnd.github.v3+json",
-        "Content-Type": "application/json"
-    }
-
-    req = urllib.request.Request(api_url, data=json.dumps(data).encode("utf-8"), headers=headers, method="POST")
-    try:
-        with urllib.request.urlopen(req) as response:
-            result = json.loads(response.read().decode("utf-8"))
-            print(f"Pull request created successfully: {result['html_url']}")
-    except urllib.error.HTTPError as e:
-        print(f"Failed to create pull request: {e.code} {e.reason}")
-        error_body = e.read().decode("utf-8")
-        print(error_body)
-
-if __name__ == "__main__":
-    main()
diff --git a/package-lock.json b/package-lock.json
index 1bd6edd6..fd86f87f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4422,9 +4422,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {