🛡️ Sentinel: [HIGH] 정책 우회 서명을 위한 암호화 검증 추가

[seonghobae]

🚨 심각도: 높음
💡 취약점: 정책 우회 기능이 임의의 하드코딩된 문자열 토큰(approvalToken)에 의존하여 시스템의 암호화 서명 검증 보안 표준을 위반했습니다.
🎯 영향: 중요한 보안 정책(예: 차단된 파일 확장자 업로드 허용)이 무단으로 쉽게 우회될 수 있습니다.
🔧 수정 사항:

• 서명 검증을 위해 HMAC-SHA256 알고리즘을 도입했습니다. approvalToken은 이제 approverId + ":" + extension 형식의 페이로드에 대한 HMAC 서명 값이어야 합니다.
• 이 서명은 conversion.policy-override-secret을 기반으로 생성 및 검증됩니다.
• 상수 시간 서명 비교를 위해 MessageDigest.isEqual을 사용하여 타이밍 공격을 방지했습니다.
  ✅ 검증: mvn test를 실행하여 새로운 HMAC 서명 유효성 검사가 성공하고 100% 테스트 커버리지가 유지되는지 확인했습니다. 유효하지 않은 서명과 설정되지 않은 시크릿에 대한 실패 사례도 추가되었습니다.

---

PR created automatically by Jules for task 9334741202511535821 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR hardens the “policy override” path (used to bypass blocked upload extensions) by replacing a hardcoded token check with cryptographic verification, making policy bypass contingent on a valid HMAC-SHA256 signature derived from a configured secret.

Changes:

• Added conversion.policy-override-secret configuration and plumbed it through ConversionProperties into DefaultDocumentValidationService.
• Implemented HMAC-SHA256 signature verification for policy overrides and updated failure modes/messages.
• Updated/expanded tests to use signed tokens and cover invalid signature / missing-secret scenarios.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java	Adds HMAC-based verification for policy override requests.
src/main/java/com/clearfolio/viewer/config/ConversionProperties.java	Introduces a new policyOverrideSecret configuration property.
src/main/resources/application.yml	Wires conversion.policy-override-secret from an environment variable.
src/test/java/com/clearfolio/viewer/service/DefaultDocumentValidationServiceTest.java	Updates tests for signed tokens; adds negative cases for invalid signature and missing secret.
src/test/java/com/clearfolio/viewer/service/ServiceInterfaceDefaultMethodsTest.java	Updates override token value in default-method delegation tests.
src/test/java/com/clearfolio/viewer/service/PolicyOverrideRequestTest.java	Updates expected approval token values in request construction tests.
src/test/java/com/clearfolio/viewer/service/DefaultDocumentConversionServiceTest.java	Updates expected forwarded approval token values.
src/test/java/com/clearfolio/viewer/controller/ConversionControllerTest.java	Updates expected forwarded approval token values.
src/test/java/com/clearfolio/viewer/controller/ConversionControllerMultipartLimitTest.java	Configures conversion.policy-override-secret for integration tests and updates signed tokens.
.jules/sentinel.md	Documents the vulnerability, learning, and prevention for Sentinel tracking.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 785766e09eba60602fc57ce0ea521c129b1ad297
• Workflow run: 28268373390
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (10 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (10 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

중복 정리(2차): '정책 서명 암호검증' 클러스터 중복 → 정본 #83 유지. 동일 목적/파일로 동시 병합 불가. 고유 변경은 #83에 반영하거나 재오픈.

[google-labs-jules]

중복 정리(2차): '정책 서명 암호검증' 클러스터 중복 → 정본 #83 유지. 동일 목적/파일로 동시 병합 불가. 고유 변경은 #83에 반영하거나 재오픈.

확인했습니다. 이 작업은 더 이상 필요하지 않은 것으로 간주하고 중단하겠습니다.