🛡️ Sentinel: [HIGH] 심볼릭 링크를 통한 경로 탐색(Path Traversal) 취약점 수정

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: File.canonicalFile 사용으로 인해 이후 Files.isDirectory(..., LinkOption.NOFOLLOW_LINKS) 검사가 심볼릭 링크 원본이 아닌 대상 디렉토리에 대해 수행되어 심볼릭 링크 제한이 우회되는 문제(Path Traversal)
🎯 Impact: 크롤러가 의도하지 않은 디렉토리 범위를 벗어나 동작하거나 임의의 위치에 index.html 파일을 덮어쓸 수 있음
🔧 Fix: .canonicalFile 대신 .absoluteFile.toPath().normalize().toFile()을 사용하여 심볼릭 링크를 따라가지 않고 논리적으로 경로를 해석하도록 수정
✅ Verification: export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64 && ./gradlew test를 실행하여 기존에 실패하던 testGoRejectsSymlinkTopDir 테스트가 성공하는지 확인

---

PR created automatically by Jules for task 8279391723999576652 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR fixes a high-severity symlink-based path traversal bypass in html4tree’s root directory validation by ensuring the provided topDir is normalized without resolving (and thereby following) symbolic links before applying NOFOLLOW_LINKS checks.

Changes:

• Replace File(topDir).canonicalFile with File(topDir).absoluteFile.toPath().normalize().toFile() so symlinks are not implicitly resolved before validation.
• Document the vulnerability cause and prevention guidance in .jules/sentinel.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/main/kotlin/html4tree/main.kt	Prevents canonicalFile from resolving symlinks before the NOFOLLOW_LINKS directory check, closing the bypass.
.jules/sentinel.md	Adds a Sentinel entry documenting the issue and the recommended prevention pattern.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.