🛡️ Sentinel: [HIGH] 인라인 스타일 CSP 해시 계산 오류 수정

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: CSP(Content-Security-Policy) 설정에서 인라인 <style> 태그에 대한 sha256 해시 계산 시, Kotlin 다중 줄 문자열(""")의 들여쓰기 공백이 포함된 상태로 해시를 계산함. 하지만 HTML 템플릿에 주입될 때 <style>\n${cssContent}</style>와 같이 줄바꿈이 추가되어 브라우저가 인식하는 실제 내용과 해시가 불일치하게 됨. 이로 인해 브라우저가 인라인 스타일을 차단하여 스타일이 적용되지 않는 문제(보안 정책 적용 오류)가 발생할 수 있음.
🎯 Impact: 잘못된 CSP 해시로 인해 브라우저에서 인라인 스타일이 차단되어 UI가 깨지거나, 이 문제를 우회하기 위해 개발자가 CSP 설정(예: unsafe-inline)을 약화시킬 위험이 있음.
🔧 Fix: cssContent에 .trimIndent()를 적용하여 들여쓰기 공백을 제거하고, HTML 주입 시 <style>${cssContent}</style>와 같이 공백 없이 주입하여 해시 계산 대상과 브라우저가 인식하는 대상이 정확히 일치하도록 수정함. 추가로, 이를 검증하는 CspTest.kt 단위 테스트를 작성함.
✅ Verification: CspTest.kt 테스트 및 ./gradlew clean test jacocoTestReport jacocoTestCoverageVerification --continue 실행 시 모든 테스트 통과 및 100% 코드 커버리지 확인됨.

---

PR created automatically by Jules for task 14987291479219800480 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Fixes CSP sha256 hash mismatches for inline <style> blocks by normalizing the hashed content and ensuring the injected HTML matches the hashed bytes exactly.

Changes:

• Normalize cssContent with .trimIndent() before hashing.
• Inject <style> content without additional newlines/indentation to keep browser hash input identical.
• Add a unit test validating the style hash matches the injected style content.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/main/kotlin/html4tree/main.kt	Aligns CSP hash input with actual <style> inner text by trimming indentation and injecting without padding.
src/test/kotlin/html4tree/CspTest.kt	Adds a regression test to validate hash equality between computed content and injected style content.
.jules/sentinel.md	Documents the vulnerability, learning, and prevention guidance for CSP hash calculation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.