🛡️ Sentinel: [MEDIUM] Fix command injection vulnerability with enhanced regex blocklist

[seonghobae]

What (구현 내용)

src/newsdom_api/mineru_runner.py의 _UNSAFE_CHARS_PATTERN에 개행 문자(\n)와 캐리지 리턴(\r)을 추가하여 명령어 인자 검증을 강화했습니다.

Why (해결하는 문제)

외부 명령어를 호출할 때(shell=False를 사용하더라도) 로그 인젝션이나 명령어 파싱 오류를 유발할 수 있는 개행 문자가 필터링되지 않고 있었습니다. 엄격한 화이트리스트 방식은 다양한 언어의 유니코드 파일 이름 처리에 문제를 일으키므로, 포괄적인 블랙리스트 방식에 개행 문자를 포함시켜 호환성을 유지하면서도 보안을 강화했습니다.

Impact (성능/영향)

유효한 유니코드 파일 경로에 영향을 주지 않으면서 명령어와 관련된 보안 취약점을 차단합니다. 변경된 로직을 검증하기 위한 테스트 코드가 추가되었습니다.

Measurement (측정/검증 방법)

uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing tests/test_mineru_runner.py tests/test_mineru_runner_paths.py 명령을 실행하여 모든 테스트가 통과하고 100% 코드 커버리지를 유지하는지 확인했습니다. .jules/sentinel.md에 관련된 보안 학습 내용을 기록했습니다.

---

PR created automatically by Jules for task 11045992470802810106 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Strengthens MinerU command-argument validation by blocking newline and carriage return characters to mitigate log injection / parsing issues, and adds regression tests to cover the new constraints.

Changes:

• Extend _UNSAFE_CHARS_PATTERN to reject \n and \r in command arguments.
• Add test cases for newline and pipe characters; rename the related test for clarity.
• Document the security learning in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/newsdom_api/mineru_runner.py	Expands the unsafe-character regex to include newline and carriage return.
tests/test_mineru_runner_paths.py	Adds regression coverage for newline/pipe disallowed characters and updates test naming/ids.
.jules/sentinel.md	Records the vulnerability context and prevention guidance for future reference.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.