Skip to content

πŸ›‘οΈ Sentinel: [λ³΄μ•ˆ ν–₯상] 검색엔진 인덱싱 방지 메타 νƒœκ·Έ μΆ”κ°€ #218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seonghobae wants to merge 1 commit into
base: master
Choose a base branch
from
+8 βˆ’0
Open

πŸ›‘οΈ Sentinel: [λ³΄μ•ˆ ν–₯상] 검색엔진 인덱싱 방지 메타 νƒœκ·Έ μΆ”κ°€ #218

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,3 +83,8 @@
**Vulnerability:** 정적 HTML 생성 λ„κ΅¬μ—μ„œ 맀번 λ‹€λ₯Έ Nonceλ₯Ό λ™μ μœΌλ‘œ μƒμ„±ν•˜μ—¬ CSP에 μ μš©ν•˜λŠ” 것은, 캐싱 νš¨μœ¨μ„ μ €ν•˜μ‹œν‚¬ 뿐만 μ•„λ‹ˆλΌ 정적 배포 ν™˜κ²½(예: GitHub Pages λ“±)μ—μ„œ μ˜¬λ°”λ₯Έ λ³΄μ•ˆ μ •μ±… μˆ˜λ¦½μ„ λ°©ν•΄ν•  수 μžˆλŠ” μ•ˆν‹° νŒ¨ν„΄μž…λ‹ˆλ‹€.
**Learning:** μ •μ μœΌλ‘œ κ³ μ •λœ 인라인 μŠ€νƒ€μΌμ΄λ‚˜ μŠ€ν¬λ¦½νŠΈμ—λŠ” λ‚œμˆ˜ν™”λœ Nonce보닀 μ½˜ν…μΈ  자체의 ν•΄μ‹œ(SHA-256 λ“±)λ₯Ό μ‚¬μš©ν•˜λŠ” 것이 μ•ˆμ „ν•˜κ³  μΌκ΄€λœ λ°©μ‹μž„μ„ λ°°μ› μŠ΅λ‹ˆλ‹€.
**Prevention:** μžλ™ μƒμ„±λ˜λŠ” 정적 HTML의 μ½˜ν…μΈ  λ³΄μ•ˆ μ •μ±…(CSP)μ—λŠ” `style-src 'sha256-<HASH>'` 방식을 μ μš©ν•˜κ³ , `<style>` νƒœκ·Έμ—μ„œ λΆˆν•„μš”ν•œ `nonce` 속성을 μ œκ±°ν•˜μ—¬ λΈŒλΌμš°μ €μ˜ 무결성 검증 κΈ°λŠ₯을 적극 ν™œμš©ν•˜μ‹­μ‹œμ˜€.

## 2026-07-19 - Add robots meta tag to prevent search indexing
**Vulnerability:** The generated directory listings were missing the robots meta tag. While directory listing output generation itself is intentional, if deployed publicly on web servers, web crawlers may index the structure and content of internal files unintentionally.
**Learning:** For static HTML generators creating file trees or directories, it's safer to provide `noindex, nofollow` out of the box to prevent accidental Information Exposure (CWE-200) when the tool is run on paths with sensitive structures.
**Prevention:** Always add `<meta name="robots" content="noindex, nofollow">` to statically generated directory listings unless indexing is a core feature requirement.
2 changes: 2 additions & 0 deletions src/main/kotlin/html4tree/main.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,6 +325,8 @@ ${cssContent} </style>
<meta name="color-scheme" content="light dark">
<!-- λ³΄μ•ˆ ν–₯상: 인라인 슀크립트 μ‹€ν–‰ 방지 -->
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src '${styleHash}'; base-uri 'none'; form-action 'none';">
<!-- λ³΄μ•ˆ ν–₯상: κ²€μƒ‰μ—”μ§„μ˜ λ¬΄λΆ„λ³„ν•œ 디렉토리 인덱싱 방지 (정보 λ…ΈμΆœ 방지) -->
<meta name="robots" content="noindex, nofollow">
<!-- λ³΄μ•ˆ ν–₯상: 리퍼러λ₯Ό ν†΅ν•œ 디렉토리 경둜 λ…ΈμΆœ 방지 -->
<meta name="referrer" content="no-referrer">
<title>${curr_dir.getName().escapeHtml()}</title>
Expand Down
1 change: 1 addition & 0 deletions src/test/kotlin/html4tree/MainTest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,6 +309,7 @@ class MainTest {
val htmlContent = indexFile.readText()
assertTrue(htmlContent.contains("<html lang=\"ko\">"))
assertTrue(htmlContent.contains("<meta name=\"color-scheme\" content=\"light dark\">"))
assertTrue(htmlContent.contains("<meta name=\"robots\" content=\"noindex, nofollow\">"))
assertTrue(htmlContent.contains("<nav aria-label=\"디렉토리 λͺ©λ‘\">"))
assertTrue(htmlContent.contains("role=\"list\""))
assertTrue(htmlContent.contains("<main>"))
Expand Down
Loading