Skip to content

🛡️ Sentinel: [정보 노출 방지] 검색 엔진 인덱싱 방지 메타 태그 추가 - #254

Closed
seonghobae wants to merge 1 commit into
masterfrom
sentinel/add-robots-meta-tag-10466809194843970435
Closed

🛡️ Sentinel: [정보 노출 방지] 검색 엔진 인덱싱 방지 메타 태그 추가#254
seonghobae wants to merge 1 commit into
masterfrom
sentinel/add-robots-meta-tag-10466809194843970435

Conversation

@seonghobae

Copy link
Copy Markdown
Collaborator

💡 What:
생성된 HTML 디렉토리 리스팅 파일의 <head> 섹션에 <meta name="robots" content="noindex, nofollow"> 메타 태그를 추가했습니다.

🎯 Why:
이 도구를 통해 생성된 정적 HTML 파일이 외부 웹 서버 등에 호스팅될 경우, 검색 엔진 크롤러가 해당 페이지를 인덱싱하여 내부 디렉토리 구조 및 파일 목록이 외부에 노출될 수 있는 정보 노출(Information Exposure) 취약점을 방어하기 위함입니다. Defense in depth 관점에서 기본적으로 봇의 접근을 차단하도록 설정했습니다.

✅ Verification:

  • 로컬에서 ./gradlew clean test jacocoTestReport jacocoTestCoverageVerification를 실행하여 모든 테스트 통과 및 코드 커버리지 100% 유지를 확인했습니다.
  • 테스트 코드(MainTest.kt)에 해당 메타 태그가 정상적으로 포함되어 렌더링되는지 확인하는 단언문(assertion)을 추가했습니다.

PR created automatically by Jules for task 10466809194843970435 started by @seonghobae

CopilotAI review requested due to automatic review settings July 23, 2026 21:02
@google-labs-jules

Copy link
Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

CopilotAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a defensive <meta name="robots" content="noindex, nofollow"> tag to generated directory listing HTML to reduce the risk of search-engine indexing (and consequent information exposure) when the output is hosted.

Changes:

  • Inserted a robots meta tag in the generated HTML <head> alongside existing security-related meta tags.
  • Added a test assertion to ensure the robots meta tag is present in generated index.html.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

FileDescription
src/main/kotlin/html4tree/main.ktAdds the robots meta tag to the generated HTML head to discourage indexing/following.
src/test/kotlin/html4tree/MainTest.ktExtends testProcessDir to assert the robots meta tag is rendered.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@opencode-agentopencode-agentBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 50c0790c7d6be7ba4ba551b0b70cb03c72001ca2.

  • Head SHA: 50c0790c7d6be7ba4ba551b0b70cb03c72001ca2

  • Workflow run: 30424279178

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Loading

@opencode-agent

Copy link
Copy Markdown

OpenCode Review Overview

  • Head SHA: 50c0790c7d6be7ba4ba551b0b70cb03c72001ca2
  • Workflow run: 30424279178
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 50c0790c7d6be7ba4ba551b0b70cb03c72001ca2.

  • Head SHA: 50c0790c7d6be7ba4ba551b0b70cb03c72001ca2

  • Workflow run: 30424279178

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Loading

@seonghobaeChatGPT Codex Connector

Copy link
Copy Markdown
CollaboratorAuthor

Closing as superseded by draft canonical #349. The same robots directive is retained there with the correct boundary: cooperative search indexing guidance is not access control and requires a crawler to retrieve the page. #349 is blocked pending post-#363 update, current Google Search Central APA 7 doctoring, changelog, real generated-page tests, exact-head checks, and independent approval. No evidence from this duplicate head is reused.

@google-labs-jules

Copy link
Copy Markdown

Closing as superseded by draft canonical #349. The same robots directive is retained there with the correct boundary: cooperative search indexing guidance is not access control and requires a crawler to retrieve the page. #349 is blocked pending post-#363 update, current Google Search Central APA 7 doctoring, changelog, real generated-page tests, exact-head checks, and independent approval. No evidence from this duplicate head is reused.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@seonghobae