🛡️ Sentinel: Permissions-Policy 보안 헤더 추가

.jules/sentinel.md

@@ -90,3 +90,8 @@
 **Vulnerability:** The `_safe_upload_filename` function used `filename.replace`, `PurePosixPath`, and `re.sub` on unbounded client input, making it vulnerable to ReDoS or CPU/memory exhaustion (DoS) when fed extremely long strings.
 **Learning:** Even fast standard library functions like `PurePosixPath` and string replacements can cause significant lag when chained on strings in the megabytes. String processing operations should always bound their inputs first if the input is untrusted and can be arbitrarily large.
 **Prevention:** Cap the length of client-provided filename strings early by slicing them (e.g. `filename = filename[-512:]`) before doing more complex string parsing or regex replacements, especially when only the basename suffix is relevant.
+
+## 2024-11-20 - Add Permissions-Policy security header
+**Vulnerability:** Missing `Permissions-Policy` header allows potential abuse of sensitive browser features (e.g. geolocation, camera, microphone) if the API response is rendered or framed in a browser context.
+**Learning:** Adding a restrictive `Permissions-Policy` header provides defense in depth by explicitly disabling unnecessary sensitive browser features for the API response.
+**Prevention:** Always include `Permissions-Policy: geolocation=(), camera=(), microphone=()` along with other standard security headers like `Content-Security-Policy` and `X-Frame-Options`.

src/newsdom_api/main.py

@@ -70,6 +70,7 @@ def _apply_security_headers(response: Response, request: Request) -> Response:
     )
     response.headers["Referrer-Policy"] = "no-referrer"
     response.headers["Cache-Control"] = "no-store, no-cache, max-age=0"
+    response.headers["Permissions-Policy"] = "geolocation=(), camera=(), microphone=()"
     forwarded_proto = request.headers.get("x-forwarded-proto", "")
     is_https = request.url.scheme == "https" or forwarded_proto.lower() == "https"
     if is_https:

src/newsdom_api/schemas.py

@@ -97,7 +97,9 @@ class ArticleNode(BaseModel):
     body_blocks: List[str] = Field(
         default_factory=list,
         description="Ordered text blocks that make up the article body.",
-        json_schema_extra={"example": ["First paragraph of the article.", "Second paragraph."]},
+        json_schema_extra={
+            "example": ["First paragraph of the article.", "Second paragraph."]
+        },
     )
     images: List[ImageNode] = Field(
         default_factory=list,

tests/test_auth.py

@@ -28,9 +28,7 @@
     security_boundary_middleware,
 )
 
-_PDF_FILES = {
-    "file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")
-}
+_PDF_FILES = {"file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")}
 
 
 def _settings(
@@ -147,9 +145,12 @@ def test_development_disabled_mode_allows_parse_and_warns_once(
     assert client.post("/parse", files=_PDF_FILES).status_code == 200
     assert parser_spy["count"] == 2
     messages = [record.getMessage() for record in caplog.records]
-    assert messages.count(
-        "Parser authentication is disabled for the explicit development profile"
-    ) == 1
+    assert (
+        messages.count(
+            "Parser authentication is disabled for the explicit development profile"
+        )
+        == 1
+    )
 
 
 def test_direct_runtime_settings_reject_invalid_security_invariants() -> None:
@@ -350,11 +351,15 @@ def test_concurrent_requests_cannot_switch_authentication_state(
     )
 
     def request(token: str) -> int:
-        return TestClient(application).post(
-            "/parse",
-            files=_PDF_FILES,
-            headers={"Authorization": f"Bearer {token}"},
-        ).status_code
+        return (
+            TestClient(application)
+            .post(
+                "/parse",
+                files=_PDF_FILES,
+                headers={"Authorization": f"Bearer {token}"},
+            )
+            .status_code
+        )
 
     tokens = ["fixed" if index % 2 == 0 else "changed" for index in range(20)]
     with ThreadPoolExecutor(max_workers=8) as executor:

tests/test_auth_deployment_contract.py

@@ -27,7 +27,7 @@ def _project_version(pyproject_text: str) -> str:
     )
     match = (
         re.search(
-            r'''^version\s*=\s*(["'])([^"']+)\1\s*(?:#.*)?$''',
+            r"""^version\s*=\s*(["'])([^"']+)\1\s*(?:#.*)?$""",
             project_table.group("body"),
             re.MULTILINE,
         )

tests/test_auth_fail_closed_contract.py

@@ -11,9 +11,7 @@
 )
 from newsdom_api.main import create_app
 
-_PDF_FILES = {
-    "file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")
-}
+_PDF_FILES = {"file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")}
 
 
 def test_default_configuration_without_token_blocks_parser_before_work(
@@ -36,12 +34,10 @@ def fake_parse_pdf(*_args, **_kwargs):
     monkeypatch.setattr("newsdom_api.main._validate_pdf_structure", lambda _: None)
     monkeypatch.setattr("newsdom_api.main.parse_pdf", fake_parse_pdf)
 
-    application = create_app(
-        settings, runtime_readiness_probe=lambda: True
+    application = create_app(settings, runtime_readiness_probe=lambda: True)
+    response = TestClient(application, raise_server_exceptions=False).post(
+        "/parse", files=_PDF_FILES
     )
-    response = TestClient(
-        application, raise_server_exceptions=False
-    ).post("/parse", files=_PDF_FILES)
 
     assert response.status_code == 503
     assert response.json() == {"detail": "Service Unavailable"}
@@ -58,13 +54,9 @@ def test_ready_fails_closed_when_required_authentication_is_unconfigured(
         runtime_profile=RuntimeProfile.PRODUCTION,
         api_token=None,
     )
-    application = create_app(
-        settings, runtime_readiness_probe=lambda: True
-    )
+    application = create_app(settings, runtime_readiness_probe=lambda: True)
 
-    response = TestClient(
-        application, raise_server_exceptions=False
-    ).get("/ready")
+    response = TestClient(application, raise_server_exceptions=False).get("/ready")
 
     assert response.status_code == 503
     assert response.json() == {"detail": "Service Unavailable"}
@@ -82,13 +74,9 @@ def test_health_remains_liveness_only_when_authentication_is_unconfigured(
         runtime_profile=RuntimeProfile.PRODUCTION,
         api_token=None,
     )
-    application = create_app(
-        settings, runtime_readiness_probe=lambda: False
-    )
+    application = create_app(settings, runtime_readiness_probe=lambda: False)
 
-    response = TestClient(
-        application, raise_server_exceptions=False
-    ).get("/health")
+    response = TestClient(application, raise_server_exceptions=False).get("/health")
 
     assert response.status_code == 200
     assert response.json() == {"status": "ok"}

tests/test_auth_protocol_edges.py

@@ -12,9 +12,7 @@
 )
 from newsdom_api.main import create_app
 
-_PDF_FILES = {
-    "file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")
-}
+_PDF_FILES = {"file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")}
 _BEARER_PREFIX = "Bearer "
 
 

tests/test_health.py

@@ -22,6 +22,10 @@ def test_healthcheck():
         response.headers.get("Strict-Transport-Security")
         == "max-age=31536000; includeSubDomains"
     )
+    assert (
+        response.headers.get("Permissions-Policy")
+        == "geolocation=(), camera=(), microphone=()"
+    )
 
 
 def test_healthcheck_omits_hsts_for_plain_http():

tests/test_parse_endpoint.py

@@ -418,6 +418,10 @@ def fake_parse_pdf_bytes(file_path, filename, **kwargs):
     )
     assert response.headers.get("Referrer-Policy") == "no-referrer"
     assert response.headers.get("Cache-Control") == "no-store, no-cache, max-age=0"
+    assert (
+        response.headers.get("Permissions-Policy")
+        == "geolocation=(), camera=(), microphone=()"
+    )
     assert "Strict-Transport-Security" not in response.headers
 
 

tests/test_project_metadata.py

@@ -172,12 +172,10 @@ def test_project_declares_python_compatible_locked_fuzz_extra():
 
     assert "fuzz = [" in text
     assert (
-        '"atheris==3.0.0 ; platform_system == \'Linux\' and '
-        'python_version == \'3.11\'"'
+        "\"atheris==3.0.0 ; platform_system == 'Linux' and python_version == '3.11'\""
     ) in text
     assert (
-        '"atheris==3.1.0 ; platform_system == \'Linux\' and '
-        'python_version >= \'3.12\'"'
+        "\"atheris==3.1.0 ; platform_system == 'Linux' and python_version >= '3.12'\""
     ) in text
     assert _locked_package_versions("atheris") == {(3, 0, 0), (3, 1, 0)}
     assert '"pyinstaller==6.21.0"' in text

tests/test_pypdf_security_floor.py

@@ -71,9 +71,7 @@ def test_trivy_registry_exception_is_scoped_to_the_example_manifest() -> None:
     ignore_document = yaml.safe_load(
         Path(".trivyignore.yaml").read_text(encoding="utf-8")
     )
-    exceptions = {
-        entry["id"]: entry for entry in ignore_document["misconfigurations"]
-    }
+    exceptions = {entry["id"]: entry for entry in ignore_document["misconfigurations"]}
 
     assert trivy_config["ignorefile"] == ".trivyignore.yaml"
     assert exceptions["KSV-0125"]["paths"] == [