🛡️ Sentinel: [MEDIUM] 보안 헤더 누락 수정

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: 보안 헤더 누락 (X-XSS-Protection, Strict-Transport-Security, X-Frame-Options)
🎯 Impact: 해당 헤더가 없을 경우 애플리케이션은 XSS, Clickjacking, 중간자 공격 등에 취약해집니다.
🔧 Fix: ViewerSecurityHeadersWebFilter.java 에 누락된 보안 헤더를 추가했습니다.
✅ Verification: 유닛 테스트를 통해 헤더가 올바르게 추가되는지 검증했습니다.

---

PR created automatically by Jules for task 17982515168884998647 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head evidence but cannot approve because required coverage evidence did not pass.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The OpenCode approval path reached an APPROVE control result while the separate coverage-evidence job result was failure.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head a6443722482a0ee6979b408079bba1d239d2f15a.

• Head SHA: a6443722482a0ee6979b408079bba1d239d2f15a

• Workflow run: 28382920619

• Workflow attempt: 1

Coverage evidence

Coverage Evidence

• Head SHA: a6443722482a0ee6979b408079bba1d239d2f15a
• Required test evidence: supported repository test suites must pass.
• Required docstring evidence: repository-owned docstring gates must pass when configured; otherwise docstring coverage is advisory.

Python test coverage

============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-9.1.1, pluggy-1.6.0
rootdir: /home/runner/work/clearfolio/clearfolio
configfile: pyproject.toml
collected 0 items

============================ no tests ran in 0.09s =============================
/home/runner/.local/lib/python3.12/site-packages/coverage/control.py:956: CoverageWarning: No data was collected. (no-data-collected); see https://coverage.readthedocs.io/en/7.14.2/messages.html#warning-no-data-collected
  self._warn("No data was collected.", slug="no-data-collected")

• Result: FAIL (exit 5)

Python coverage report

No data to report.

• Result: FAIL (exit 1)

Python docstring coverage advisory

RESULT: PASSED (minimum: 80.0%, actual: 100.0%)

• Result: PASS

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 2

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 7dbd4de43418a30ff57085e85d6a8404ad4e6602
• Workflow run: 28863012445
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was cancelled, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was cancelled, so required test/docstring evidence was not proven for current head 7dbd4de43418a30ff57085e85d6a8404ad4e6602.

• Head SHA: 7dbd4de43418a30ff57085e85d6a8404ad4e6602

• Workflow run: 28863012445

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head evidence but cannot approve because required coverage evidence did not pass.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The OpenCode approval path reached an APPROVE control result while the separate coverage-evidence job result was failure.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head e2f38b4e81a28da775a09dd4f8e3de3a8dd74e19.

• Head SHA: e2f38b4e81a28da775a09dd4f8e3de3a8dd74e19

• Workflow run: 28388630720

• Workflow attempt: 1

Coverage evidence

Coverage Evidence

• Head SHA: e2f38b4e81a28da775a09dd4f8e3de3a8dd74e19
• Required test evidence: supported repository test suites must pass.
• Required docstring evidence: repository-owned docstring gates must pass when configured; otherwise docstring coverage is advisory.

Python test coverage

============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-9.1.1, pluggy-1.6.0
rootdir: /home/runner/work/clearfolio/clearfolio
configfile: pyproject.toml
collected 0 items

============================ no tests ran in 0.09s =============================
/home/runner/.local/lib/python3.12/site-packages/coverage/control.py:956: CoverageWarning: No data was collected. (no-data-collected); see https://coverage.readthedocs.io/en/7.14.2/messages.html#warning-no-data-collected
  self._warn("No data was collected.", slug="no-data-collected")

• Result: FAIL (exit 5)

Python coverage report

No data to report.

• Result: FAIL (exit 1)

Python docstring coverage advisory

RESULT: PASSED (minimum: 80.0%, actual: 100.0%)

• Result: PASS

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 2

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

정리(중복): 이 PR의 목적인 뷰어 보안 헤더는 현재 main의 ViewerSecurityHeadersWebFilter에 이미 구현되어 있습니다(CSP frame-ancestors 설정 가능, X-Content-Type-Options: nosniff 등). 본 브랜치는 DIRTY(병합 불가)이고 8일 이상 정체되어 중복 PR 정리 방침에 따라 닫습니다. 필요 시 재오픈 가능합니다.

[google-labs-jules]

정리(중복): 이 PR의 목적인 뷰어 보안 헤더는 현재 main의 ViewerSecurityHeadersWebFilter에 이미 구현되어 있습니다(CSP frame-ancestors 설정 가능, X-Content-Type-Options: nosniff 등). 본 브랜치는 DIRTY(병합 불가)이고 8일 이상 정체되어 중복 PR 정리 방침에 따라 닫습니다. 필요 시 재오픈 가능합니다.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.

[seonghobae]

재정리: Jules 봇이 직전 코멘트에서 "this work is now obsolete, stopping work on this task"로 중복/폐기에 동의했습니다. 봇 응답 과정에서 자동 재오픈된 것으로 보여, 봇 자신의 결론과 일치하게 다시 닫습니다. (보안 헤더는 main ViewerSecurityHeadersWebFilter에 이미 존재.) 재차 열릴 경우 오너 판단에 맡깁니다.

[seonghobae]

Rebased onto current main so the diff is limited to the viewer security filter + its test (X-Frame-Options/HSTS/X-XSS-Protection), which clears the coverage-evidence gate that was tripping on a stale untested CI script; mvn -q verify is green.

[google-labs-jules]

재정리: Jules 봇이 직전 코멘트에서 "this work is now obsolete, stopping work on this task"로 중복/폐기에 동의했습니다. 봇 응답 과정에서 자동 재오픈된 것으로 보여, 봇 자신의 결론과 일치하게 다시 닫습니다. (보안 헤더는 main ViewerSecurityHeadersWebFilter에 이미 존재.) 재차 열릴 경우 오너 판단에 맡깁니다.

Understood. Acknowledging that this work is now obsolete and stopping work on this task. I will not reopen the pull request.

[github-actions]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was cancelled, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was cancelled, so required test/docstring evidence was not proven for current head 7dbd4de43418a30ff57085e85d6a8404ad4e6602.

• Head SHA: 7dbd4de43418a30ff57085e85d6a8404ad4e6602

• Workflow run: 28863012445

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading