🛡️ Sentinel: [HIGH] Fix XSS vulnerability in href scheme validation

[seonghobae]

🚨 심각도: HIGH
💡 취약점: 외부 입력 데이터(PR URL)를 바탕으로 HTML을 렌더링할 때, html.escape는 적용되었지만 안전하지 않은 URL Scheme(javascript:, data: 등)에 대한 검증이 누락되어 악의적인 스크립트가 href에 삽입될 수 있는 XSS(Cross-Site Scripting) 취약점이 발견되었습니다.
🎯 영향: 공격자가 조작된 URL을 삽입할 경우 생성된 HTML 보고서를 조회하는 사용자의 브라우저에서 임의의 자바스크립트가 실행되어 세션 탈취 등 2차 피해가 발생할 수 있습니다.
🔧 수정: urllib.parse를 통해 URL의 Scheme을 파싱하고 허용된 목록(http, https, mailto) 이외의 Scheme이 들어오면 #으로 대체하여 안전하게 렌더링하도록 _safe_url 함수를 구현하여 적용하였습니다.
✅ 검증 방법:

• pnpm test 혹은 제공된 스크립트를 통해 _safe_url 함수의 동작을 테스트하여 안전한 프로토콜이 아닌 경우 모두 방어함을 확인하였습니다. (tests/test_pr_queue_governance.py 내 단위 테스트 추가 완료)

---

PR created automatically by Jules for task 17756520195623399382 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[seonghobae]

Cleaned this PR to the surviving security improvement on top of current main.

Current head: 8a34b62
Current diff:

• scripts/build_pr_queue_governance.py
• tests/test_pr_queue_governance.py

What changed:

• Kept the existing main CSP and sentinel state intact.
• Replaced prefix-only URL blocking with a small scheme allowlist for PR report links: http, https, mailto, plus relative URLs.
• Avoided stringifying None into the literal href None; non-string/empty URLs now become #.
• Added regression coverage for allowed schemes, relative URLs, javascript:, data:, vbscript:, ftp:, empty string, and None.

Local verification: py -m pytest tests/test_pr_queue_governance.py -> 4 passed. git diff --check reported only Windows CRLF warnings.

Merge order note: this is prepared for review/checks, but it stays behind lower-numbered PRs #18, #27, and #47.

[google-labs-jules]

Cleaned this PR to the surviving security improvement on top of current main.

Current head: 8a34b62
Current diff:

• scripts/build_pr_queue_governance.py
• tests/test_pr_queue_governance.py

What changed:

• Kept the existing main CSP and sentinel state intact.
• Replaced prefix-only URL blocking with a small scheme allowlist for PR report links: http, https, mailto, plus relative URLs.
• Avoided stringifying None into the literal href None; non-string/empty URLs now become #.
• Added regression coverage for allowed schemes, relative URLs, javascript:, data:, vbscript:, ftp:, empty string, and None.

Local verification: py -m pytest tests/test_pr_queue_governance.py -> 4 passed. git diff --check reported only Windows CRLF warnings.

Merge order note: this is prepared for review/checks, but it stays behind lower-numbered PRs #18, #27, and #47.

Acknowledged.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 92373722640a01f062b38fae87c1a19ab3222147
• Workflow run: 29079565343
• Workflow attempt: 1
• Gate result: APPROVE (approval step)

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including scripts/build_pr_queue_governance.py, tests/test_pr_queue_governance.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects scripts/build_pr_queue_governance.py to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

• Result: APPROVE
• Reason: PR fixes a HIGH-severity XSS vulnerability with robust validation and no regressions.
• Head SHA: 92373722640a01f062b38fae87c1a19ab3222147
• Workflow run: 29079565343
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: build_pr_queue_governance.py"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: build_pr_queue_governance.py"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_pr_queue_governance.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_pr_queue_governance.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including scripts/build_pr_queue_governance.py, tests/test_pr_queue_governance.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects scripts/build_pr_queue_governance.py to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

• Result: APPROVE
• Reason: PR fixes a HIGH-severity XSS vulnerability with robust validation and no regressions.
• Head SHA: 92373722640a01f062b38fae87c1a19ab3222147
• Workflow run: 29079565343
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: build_pr_queue_governance.py"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: build_pr_queue_governance.py"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_pr_queue_governance.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_pr_queue_governance.py"]
  R2 --> V2["targeted test run"]

Loading

[seonghobae]

Current-head remediation and merge blocker update:

• Rebuilt the PR branch on current main so the PR diff is now only:
  • scripts/build_pr_queue_governance.py
  • tests/test_pr_queue_governance.py
• Fixed the real HIGH XSS issue by allowing only http, https, mailto, and relative URLs in generated PR-report links; non-string/empty/unsafe schemes now render as #.
• Local verification: py -m pytest -> 132 passed, 3 skipped.
• Current-head GitHub Checks are green: CI python/rust/package, CodeQL, Security Scan (osv-scan, dependency-review, trivy-fs, scorecard), Strix, OpenCode coverage/docstring evidence, and OpenCode review.
• OpenCode approved current head 92373722640a01f062b38fae87c1a19ab3222147.
• Cancelled stale previous-head run 29079437651; force-cancelled stale previous-head OpenCode run 29079436943 after it continued past the force-push.
• Enabled policy-compliant auto-merge with merge method.

Remaining blocker is not a test/security failure: org ruleset CWL Central required workflows requires native PR approvals (required_approving_review_count=2, require_code_owner_review=true, require_last_push_approval=true). GitHub still reports reviewDecision=REVIEW_REQUIRED, so auto-merge is waiting on those native approvals.

[google-labs-jules]

Current-head remediation and merge blocker update:

• Rebuilt the PR branch on current main so the PR diff is now only:
  • scripts/build_pr_queue_governance.py
  • tests/test_pr_queue_governance.py
• Fixed the real HIGH XSS issue by allowing only http, https, mailto, and relative URLs in generated PR-report links; non-string/empty/unsafe schemes now render as #.
• Local verification: py -m pytest -> 132 passed, 3 skipped.
• Current-head GitHub Checks are green: CI python/rust/package, CodeQL, Security Scan (osv-scan, dependency-review, trivy-fs, scorecard), Strix, OpenCode coverage/docstring evidence, and OpenCode review.
• OpenCode approved current head 92373722640a01f062b38fae87c1a19ab3222147.
• Cancelled stale previous-head run 29079437651; force-cancelled stale previous-head OpenCode run 29079436943 after it continued past the force-push.
• Enabled policy-compliant auto-merge with merge method.

Remaining blocker is not a test/security failure: org ruleset CWL Central required workflows requires native PR approvals (required_approving_review_count=2, require_code_owner_review=true, require_last_push_approval=true). GitHub still reports reviewDecision=REVIEW_REQUIRED, so auto-merge is waiting on those native approvals.

알겠습니다. 수정 및 확인 과정 완료된 점 인지하였습니다.