From b21ba719b2ecb10bd206547c0dd0e2f53f5ca5fc Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 28 Jun 2026 21:02:44 +0000
Subject: [PATCH] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=ED=96=A5=EC=83=81:=20?=
=?UTF-8?q?=EC=83=9D=EC=84=B1=EB=90=9C=20HTML=EC=97=90=20Content-Security-?=
=?UTF-8?q?Policy=20(CSP)=20=EB=A9=94=ED=83=80=20=ED=83=9C=EA=B7=B8=20?=
=?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
생성되는 index.html 파일에 `default-src 'none'; style-src 'unsafe-inline';` 정책을 포함하는 Content-Security-Policy 메타 태그를 추가하여, 잠재적인 XSS 취약점에 대한 방어 계층(Defense in Depth)을 강화했습니다.
MainTest.kt에 CSP 태그가 올바르게 추가되었는지 확인하는 테스트를 추가했습니다.
---
.jules/sentinel.md | 4 ++++
src/main/kotlin/html4tree/main.kt | 2 ++
src/test/kotlin/html4tree/MainTest.kt | 2 ++
3 files changed, 8 insertions(+)
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index f8123939..615dbf62 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -2,3 +2,7 @@
**Vulnerability:** XSS via Malicious File/Directory Names
**Learning:** Tools that auto-generate static HTML pages from local file systems often overlook input sanitization, implicitly trusting local file paths. If these generated pages are hosted or shared, an attacker can create files with names like `` to execute arbitrary JavaScript in the context of the user viewing the generated index.
**Prevention:** Always HTML-encode variable data injected into HTML templates, and URL-encode data used in `href` attributes, regardless of the data's origin (even if it's "just" the local file system). Additionally, ensure HTML attributes like `href` are properly quoted to prevent attribute breakout.
+## 2024-06-28 - [html4tree] Static HTML Generation Security
+**Vulnerability:** Defense in Depth (CSP Missing)
+**Learning:** Even when inputs are properly escaped, statically generated HTML that displays file/directory structures should implement a Content Security Policy (CSP) to provide an extra layer of defense against potential XSS bypasses.
+**Prevention:** Include a strict CSP meta tag (e.g., `default-src 'none'; style-src 'unsafe-inline';`) in auto-generated HTML headers when external scripts or resources are not required.
diff --git a/src/main/kotlin/html4tree/main.kt b/src/main/kotlin/html4tree/main.kt
index 50b2680d..6af1a45b 100644
--- a/src/main/kotlin/html4tree/main.kt
+++ b/src/main/kotlin/html4tree/main.kt
@@ -114,6 +114,8 @@ fun process_dir(curr_dir: File){
+
+
${curr_dir.getName().escapeHtml()}
${css}
diff --git a/src/test/kotlin/html4tree/MainTest.kt b/src/test/kotlin/html4tree/MainTest.kt
index 31c193a2..10a613bc 100644
--- a/src/test/kotlin/html4tree/MainTest.kt
+++ b/src/test/kotlin/html4tree/MainTest.kt
@@ -115,6 +115,8 @@ class MainTest {
assertTrue(htmlContent.contains("subdir/"))
assertTrue(htmlContent.contains("📁"))
assertFalse(htmlContent.contains("test.ignore"))
+ assertTrue(htmlContent.contains("Content-Security-Policy"))
+ assertTrue(htmlContent.contains("default-src 'none'; style-src 'unsafe-inline';"))
}
@Test