Uh oh!
There was an error while loading. Please reload this page.
🛡️ Sentinel: [HIGH] Fix XSS vulnerability - #9
Conversation
* Added `escapeHtml` to sanitize filenames when rendered as text * Added `encodeUrlPathSegment` to safely include filenames in href attributes * Fixed unquoted href attribute issue
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
seonghobae
commented
Jun 29, 2026
Closing this as superseded rather than merging it. Current-head evidence:
PR created automatically by Jules for task 1717385208084772770 started by @seonghobae; created_at=2026-06-23T03:11:07Z; updated_at=2026-06-28T22:44:11Z; closed_at=; merged_at=; merge_commit_sha=1d983b5b371f5c8d4721800970c783d78571665a; assignees=System.Object[]; requested_reviewers=System.Object[]; requested_teams=System.Object[]; labels=System.Object[]; milestone=; draft=False; commits_url=https://api.github.com/repos/ContextualWisdomLab/html4tree/pulls/9/commits; review_comments_url=https://api.github.com/repos/ContextualWisdomLab/html4tree/pulls/9/comments; review_comment_url=https://api.github.com/repos/ContextualWisdomLab/html4tree/pulls/comments{/number}; comments_url=https://api.github.com/repos/ContextualWisdomLab/html4tree/issues/9/comments; statuses_url=https://api.github.com/repos/ContextualWisdomLab/html4tree/statuses/0e7eba9a9e903b1e75524e512794dd429105d3a7; head=; base=; _links=; author_association=MEMBER; auto_merge=; assignee=; active_lock_reason=; merged=False; mergeable=True; rebaseable=False; mergeable_state=clean; merged_by=; comments=1; review_comments=0; maintainer_can_modify=False; commits=2; additions=1; deletions=1; changed_files=1}.head.sha)
The PR title claims an XSS fix, but current master already contains the substantive escaping/URL-encoding work and tests. This PR no longer carries the claimed security implementation and has no same-head central Strix/OpenCode/scheduler approval evidence. Per the central governance policy in ContextualWisdomLab/.github, active html4tree PRs must not bypass the central review gate. |
Understood. Acknowledging that this PR has been superseded and is now closed. |
🚨 Severity: HIGH
💡 Vulnerability: 생성된
index.html에서 디렉토리 이름과 파일 이름을 이스케이프 처리 없이 직접 삽입하여 크로스 사이트 스크립팅(XSS) 취약점이 발생했습니다. 또한href속성 값에 따옴표가 없어 추가적인 공격 벡터가 존재했습니다.🎯 Impact: 공격자가 악의적인 HTML이나 스크립트가 포함된 파일이나 디렉토리를 생성하면, 생성된
index.html을 보는 사용자의 브라우저에서 해당 스크립트가 실행되어 세션 탈취 등의 피해가 발생할 수 있습니다.🔧 Fix:
escapeHtml함수를 추가하여 특수 문자(&,<,>,",')를 안전하게 변환하고, 파일 이름을href에 사용할 때는URLEncoder.encode를 사용하여 적절히 인코딩하는encodeUrlPathSegment함수를 추가했습니다. 또한href속성 값을 따옴표로 감쌌습니다.✅ Verification:
test_dir에<script>alert(1)</script>.txt와 같은 악의적인 파일 이름을 가진 파일을 생성하고java -jar ./build/libs/app.jar test_dir를 실행하여 생성된index.html에 스크립트가 안전하게 이스케이프 처리되었는지 확인했습니다. (Windows 호환성을 위해 악성 파일 이름은 저장소에 커밋하지 않았습니다.)PR created automatically by Jules for task 1717385208084772770 started by @seonghobae