🛡️ Sentinel: [CRITICAL] 파일 업로드 경로 조작(Path Traversal) 취약점 수정

[seonghobae]

🚨 Severity: CRITICAL
💡 Vulnerability: 파일 업로드 시 MultipartFile.getOriginalFilename() 값을 검증 없이 사용하여 발생할 수 있는 경로 조작(Path Traversal) 취약점 발견.
🎯 Impact: 공격자가 디렉토리 탐색 문자열(../)을 포함한 파일명을 전송하여 의도하지 않은 경로에 파일을 저장하거나 시스템 파일(예: /etc/passwd)에 접근/조작할 위험이 있음.
🔧 Fix: DefaultDocumentConversionService 및 DefaultDocumentValidationService에서 파일명을 사용하기 전 StringUtils.cleanPath()를 통해 경로를 정규화하고, 마지막 / 이후의 순수한 파일명만 추출하도록 sanitizeFilename 메소드를 추가하여 안전하게 처리함.
✅ Verification: 단위 테스트(submitStripsDirectoryTraversalFromOriginalFilename 및 stripsDirectoryTraversalFromFilename)를 추가하여 취약점 문자열이 정상적으로 제거되는지 검증 완료. (100% 테스트 커버리지 유지)

---

PR created automatically by Jules for task 10152229827960603039 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 73c20c545c098b5484bcc9e213ef187e677aed7f
• Workflow run: 28911498625
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (8 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (8 files)"]
  R1 --> V1["required checks"]

Loading