🛡️ Sentinel: [MEDIUM] 생성된 HTML의 CSP 해시 불일치 오류 수정

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: CSP style-src 해시값이 실제 <style> 태그 내부 텍스트와 일치하지 않아, 브라우저가 CSS 렌더링을 차단하는 문제가 있었습니다.
🎯 Impact: 인라인 스타일이 브라우저의 Content Security Policy에 의해 차단되어 UI 렌더링이 깨집니다.
🔧 Fix: main.kt에서 <style> 태그 내부의 Kotlin 템플릿 공백 및 줄바꿈을 제거하여 해시 대상 원본과 출력되는 값이 정확히 일치하도록 수정했습니다.
✅ Verification: ./gradlew test 통과 및 통합 테스트에서 CSP 정규식 매치 테스트 통과 확인.

---

PR created automatically by Jules for task 3262535126628893184 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Fixes a CSP regression in the generated index.html where the style-src SHA-256 hash did not match the actual <style> tag contents due to template-introduced whitespace, causing browsers to block the inline CSS in some cases.

Changes:

• Remove extra whitespace/newlines around injected CSS so the <style> inner text matches the hashed string.
• Add a regression test that recomputes the SHA-256 hash from the rendered <style> content and compares it to the CSP style-src value.
• Document the incident and prevention guidance in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/main/kotlin/html4tree/main.kt	Ensures the <style> tag wraps cssContent without extra padding so CSP hash validation matches browser behavior.
src/test/kotlin/html4tree/MainTest.kt	Adds a regression test asserting the generated CSP style-src hash matches the actual inline style contents.
.jules/sentinel.md	Records the CSP hash mismatch issue and prevention guidance for future changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (2)

src/test/kotlin/html4tree/MainTest.kt:561

• If the CSP regex doesn't match, actualHash becomes null and the test failure is less direct (it will compare against null rather than clearly stating the CSP entry was missing). Adding an explicit assertion makes failures easier to diagnose.

        val hashRegex = Regex("style-src '([^']+)'")
        val match = hashRegex.find(content)
        val actualHash = match?.groupValues?.get(1)

src/test/kotlin/html4tree/MainTest.kt:566

• If <style>...</style> isn't found, the current styleContent!! causes an NPE that obscures the real assertion failure. Add an explicit assertion and avoid !! so the test fails with a clear message when the generated HTML changes.

        val styleContentRegex = Regex("<style>([\\s\\S]*?)</style>")
        val styleMatch = styleContentRegex.find(content)
        val styleContent = styleMatch?.groupValues?.get(1)
        val expectedHash = "sha256-" + java.util.Base64.getEncoder().encodeToString(java.security.MessageDigest.getInstance("SHA-256").digest(styleContent!!.toByteArray(Charsets.UTF_8)))
        assertEquals(expectedHash, actualHash)