From d4a48579175dce6cccad6242fb9ca421162d77f9 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:16:03 +0000 Subject: [PATCH 1/4] =?UTF-8?q?=EB=B3=B4=EC=95=88:=20Math.random=EC=9D=84?= =?UTF-8?q?=20crypto.randomBytes=EB=A1=9C=20=EA=B5=90=EC=B2=B4=ED=95=98?= =?UTF-8?q?=EC=97=AC=20=EC=9E=84=EC=8B=9C=20=ED=8C=8C=EC=9D=BC=20=EC=9D=B4?= =?UTF-8?q?=EB=A6=84=20=EC=98=88=EC=B8=A1=20=EA=B0=80=EB=8A=A5=EC=84=B1=20?= =?UTF-8?q?=EC=A0=9C=EA=B1=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .jules/sentinel.md | 5 +++++ packages/cli/src/lib/event-sender.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 7902c442..bc0568d2 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -30,3 +30,8 @@ **Vulnerability:** Known high-severity vulnerabilities discovered by the audit in `js-yaml` and `nanoid` packages. **Learning:** Deeply nested dependencies (`js-yaml` via `eslint`, `nanoid` via `vitest/vite`) may expose the application to DoS or logic loops. **Prevention:** Use `pnpm.overrides` in the root `package.json` to enforce patched versions across all transitive paths in a pnpm workspace. + +## 2025-02-18 - [임시 파일의 취약한 난수 생성] +**Vulnerability:** `Math.random()`을 사용하여 임시 파일 이름의 임의성을 생성하고 있었습니다 (`Math.random().toString(36).slice(2)`). +**Learning:** `Math.random()`은 암호학적으로 안전하지 않은 의사 난수 생성기(PRNG)입니다. 임시 파일 이름 생성 등 보안 관련 식별자 생성에 사용될 경우, 예측 가능성으로 인해 보안 위험(예: Temp file name collision, predictable temp file)을 초래할 수 있습니다. +**Prevention:** 보안이 중요하거나 예측 불가능성이 보장되어야 하는 랜덤 값이 필요할 때는 항상 Node.js의 `crypto.randomBytes()`와 같은 암호학적으로 안전한 난수 생성기(CSPRNG)를 사용해야 합니다. diff --git a/packages/cli/src/lib/event-sender.ts b/packages/cli/src/lib/event-sender.ts index 01a74d05..0e0b056d 100644 --- a/packages/cli/src/lib/event-sender.ts +++ b/packages/cli/src/lib/event-sender.ts @@ -97,7 +97,7 @@ export function buildSelfHealScript({ // Step 10: Merge new orgId/orgSlug, preserving all other fields and key order `const updated={...latest,orgId:body.project.orgId,orgSlug:body.project.orgSlug};`, // Step 11: Atomic write via tmp + renameSync - `atomicTmp=${projectJsonPathJson}+'.tmp.'+process.pid+'.'+Math.random().toString(36).slice(2);`, + `atomicTmp=${projectJsonPathJson}+'.tmp.'+process.pid+'.'+require('crypto').randomBytes(8).toString('hex');`, `fs.writeFileSync(atomicTmp,JSON.stringify(updated,null,2),'utf8');`, `fs.renameSync(atomicTmp,${projectJsonPathJson});`, `}catch{try{if(atomicTmp)fs.unlinkSync(atomicTmp);}catch{}}finally{try{fs.rmdirSync(lockDir);}catch{}}`, From b7ce11f32233cc32593f94824cee43ad898751b3 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:21:36 +0000 Subject: [PATCH 2/4] =?UTF-8?q?chore:=20=EC=99=B8=EB=B6=80=20CI=20?= =?UTF-8?q?=EA=B2=B0=EC=A0=9C=20=EC=98=A4=EB=A5=98=20=EC=9D=B8=EC=A7=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From 8f57000e21bf4fcbce09fb6e2b3395eb00ea3168 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:37:07 +0000 Subject: [PATCH 3/4] =?UTF-8?q?chore:=20=EC=99=B8=EB=B6=80=20CI=20?= =?UTF-8?q?=EA=B2=B0=EC=A0=9C=20=EC=98=A4=EB=A5=98=202=EC=B0=A8=20?= =?UTF-8?q?=EC=9D=B8=EC=A7=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From bbfdc1440ccf853e55bf61c0035ec14e864122a4 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:42:43 +0000 Subject: [PATCH 4/4] =?UTF-8?q?chore:=20=EC=99=B8=EB=B6=80=20CI=20?= =?UTF-8?q?=EA=B2=B0=EC=A0=9C=20=EC=98=A4=EB=A5=98=203=EC=B0=A8=20?= =?UTF-8?q?=EC=9D=B8=EC=A7=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit