🛡️ Sentinel: [MEDIUM] Fix DoS and resource exhaustion in ignore file processing

[seonghobae]

• 🚨 Severity: MEDIUM
• 💡 Vulnerability: 로컬 DoS (서비스 거부) 및 심볼릭 링크 우회 취약점. 악의적인 사용자가 .html4ignore를 디렉토리로 만들거나 거대한 크기의 파일로 만들어 프로그램 크래시나 자원 고갈을 유도할 수 있었습니다. 또한 루트 디렉토리 검증 로직이 canonicalFile을 사용하여 심볼릭 링크를 미리 해석해버리기 때문에 NOFOLLOW_LINKS 옵션이 무용지물이 되는 버그가 있었습니다.
• 🎯 Impact: 애플리케이션 크래시 (java.io.FileNotFoundException) 또는 OOM (Out Of Memory) 자원 고갈.
• 🔧 Fix: .html4ignore 로드 전에 isFile() 체크와 length() <= 1048576 (1MB 제한) 검증을 추가했습니다. 또한 go() 함수에서 canonicalFile 대신 absoluteFile을 사용하여 심볼릭 링크가 올바르게 거부되도록 하였습니다. 관련 보안 테스트 코드를 추가하였습니다.
• ✅ Verification: ./gradlew test jacocoTestReport jacocoTestCoverageVerification 명령어를 통해 모든 테스트 통과 및 100% 커버리지를 확인했습니다.

---

PR created automatically by Jules for task 14696572090787836692 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR hardens directory traversal and .html4ignore loading to mitigate local DoS/resource exhaustion and to correctly reject symlinked top directories, with accompanying regression tests and a security note update.

Changes:

• Reject symlinked topDir by switching go() from canonicalFile to absoluteFile before NOFOLLOW_LINKS directory validation.
• Add .html4ignore validation (must be a file and ≤ 1MB) to avoid crashes/OOM on malicious ignore inputs.
• Add tests for directory/oversized .html4ignore cases and document the incident in Sentinel notes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/main/kotlin/html4tree/main.kt	Tightens top directory validation and adds size/type gating before parsing .html4ignore.
src/test/kotlin/html4tree/SentinelTest.kt	Adds regression tests covering malicious ignore-file shapes (directory / too large).
.jules/sentinel.md	Documents the DoS scenario and the preventative guidance.

Comments suppressed due to low confidence (1)

src/main/kotlin/html4tree/main.kt:95

• The new .html4ignore validation still follows symlinks and accepts non-regular files. A malicious user can make .html4ignore a symlink to a special file like /dev/zero (size reported as 0, isFile() true), causing forEachLine to hang indefinitely (DoS). Also, if the ignore file is unreadable or changes between the checks and forEachLine, the code can still throw and crash. Use Files.isRegularFile(..., NOFOLLOW_LINKS) (reject symlinks/devices) and guard the size/read with a try/catch so ignore-file parsing failures degrade to “no ignores” instead of crashing.

    if(ignore_file.exists() && ignore_file.isFile() && ignore_file.length() <= 1048576){ // Limit to 1MB
       val ignored_regexes = mutableListOf<Regex>()

       ignore_file.forEachLine {
           val pattern = it.trim()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Pull request overview

OpenCode exhausted the configured model pool without a usable current-head review conclusion. This is not approval evidence, so the PR is blocked until a source-backed review can establish approval sufficiency or identify concrete fixes.

Findings

1. HIGH .jules/sentinel.md:1 - OpenCode could not establish approval sufficiency

• Problem: every configured model path failed to produce a usable current-head control block.
• Root cause: model execution, timeout, export, normalization, or approval-gate validation did not complete after exponential retry across the configured model pool.
• Impact: approving from deterministic check state alone would miss PR-intent mismatches, missing files, edge-case bugs, robustness gaps, UX/DX regressions, security issues, and CodeGraph-backed base/head flow changes.
• Fix: rerun OpenCode after model availability recovers, or update the PR with the missing files, tests, docs, generated artifacts, and verification evidence needed for a source-backed review conclusion.
• Regression test: keep the approval gate posting REQUEST_CHANGES, not APPROVE or check-only failure, when no model produces a valid current-head review.

Summary

• Result: REQUEST_CHANGES
• Reason: coverage-evidence passed and peer GitHub Checks completed without failures, but no model produced a valid review control block.
• Deterministic evidence checked but not used for approval: current-head changed-file evidence (.jules/sentinel.md, src/main/kotlin/html4tree/main.kt, src/test/kotlin/html4tree/SentinelTest.kt); coverage-evidence result success; peer checks from statusCheckRollup excluding this OpenCode check.
• Model outcome: model_pool=exhausted; selected_model=none.
• Head SHA: 8d94de8bb0fad2c19a6b747505f9bc53a20e91e6
• Workflow run: 28562717559
• Workflow attempt: 1

No PR approval was posted because model-output failure is not evidence that the PR has no blockers.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[github-actions]

HIGH OpenCode could not establish approval sufficiency

• Problem: the model pool exhausted without a valid current-head review control block, so this changed line cannot be approved from deterministic check state alone.
• Impact: PR-intent mismatches, missing files, robustness bugs, UX/DX regressions, and CodeGraph-backed flow changes could be missed.
• Fix: rerun OpenCode after model availability recovers, or add the missing source/test/docs/generated verification evidence needed for a source-backed approval.
• Verification: rerun the OpenCode Review workflow and confirm it emits APPROVE or source-backed REQUEST_CHANGES for this head SHA.

[github-actions]

OpenCode Review Overview

• Head SHA: 8d94de8bb0fad2c19a6b747505f9bc53a20e91e6
• Workflow run: 28562717559
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode exhausted the configured model pool without a usable current-head review conclusion. This is not approval evidence, so the PR is blocked until a source-backed review can establish approval sufficiency or identify concrete fixes.

Findings

1. HIGH .jules/sentinel.md:1 - OpenCode could not establish approval sufficiency

• Problem: every configured model path failed to produce a usable current-head control block.
• Root cause: model execution, timeout, export, normalization, or approval-gate validation did not complete after exponential retry across the configured model pool.
• Impact: approving from deterministic check state alone would miss PR-intent mismatches, missing files, edge-case bugs, robustness gaps, UX/DX regressions, security issues, and CodeGraph-backed base/head flow changes.
• Fix: rerun OpenCode after model availability recovers, or update the PR with the missing files, tests, docs, generated artifacts, and verification evidence needed for a source-backed review conclusion.
• Regression test: keep the approval gate posting REQUEST_CHANGES, not APPROVE or check-only failure, when no model produces a valid current-head review.

Summary

• Result: REQUEST_CHANGES
• Reason: coverage-evidence passed and peer GitHub Checks completed without failures, but no model produced a valid review control block.
• Deterministic evidence checked but not used for approval: current-head changed-file evidence (.jules/sentinel.md, src/main/kotlin/html4tree/main.kt, src/test/kotlin/html4tree/SentinelTest.kt); coverage-evidence result success; peer checks from statusCheckRollup excluding this OpenCode check.
• Model outcome: model_pool=exhausted; selected_model=none.
• Head SHA: 8d94de8bb0fad2c19a6b747505f9bc53a20e91e6
• Workflow run: 28562717559
• Workflow attempt: 1

No PR approval was posted because model-output failure is not evidence that the PR has no blockers.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading