From 6291733832b6b6d818e230832eba0a1c1c4e8785 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 21 Jul 2026 03:55:02 +0000
Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM?=
=?UTF-8?q?]=20=EC=83=9D=EC=84=B1=EB=90=9C=20HTML=EC=9D=98=20CSP=20?=
=?UTF-8?q?=ED=95=B4=EC=8B=9C=20=EB=B6=88=EC=9D=BC=EC=B9=98=20=EC=98=A4?=
=?UTF-8?q?=EB=A5=98=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
๐จ Severity: MEDIUM
๐ก Vulnerability: CSP `style-src` ํด์๊ฐ์ด ์ค์ ` tags. When using string interpolation in Kotlin multiline strings, any surrounding whitespace inside the tags alters the final output, rendering the CSP hash invalid and blocking the style.
+**Prevention:** When injecting content into a
+
"""
val index_top = """
diff --git a/src/test/kotlin/html4tree/MainTest.kt b/src/test/kotlin/html4tree/MainTest.kt
index 1349471..72f0100 100644
--- a/src/test/kotlin/html4tree/MainTest.kt
+++ b/src/test/kotlin/html4tree/MainTest.kt
@@ -531,6 +531,23 @@ class MainTest {
assertEquals("A1z", "A1z".urlEncodePath())
}
+ @Test
+ fun testCspHashMatch() {
+ val tempDir2 = File(tempDir, "cspDir")
+ tempDir2.mkdir()
+ process_dir(tempDir2)
+ val indexFile = File(tempDir2, "index.html")
+ val content = indexFile.readText()
+ val hashRegex = Regex("style-src '([^']+)'")
+ val match = hashRegex.find(content)
+ val actualHash = match?.groupValues?.get(1)
+ val styleContentRegex = Regex("")
+ val styleMatch = styleContentRegex.find(content)
+ val styleContent = styleMatch?.groupValues?.get(1)
+ val expectedHash = "sha256-" + java.util.Base64.getEncoder().encodeToString(java.security.MessageDigest.getInstance("SHA-256").digest(styleContent!!.toByteArray(Charsets.UTF_8)))
+ assertEquals(expectedHash, actualHash)
+ }
+
@Test
fun testUrlEncodePathReservedHexCoverage() {
// Need characters that produce hex digit > 9 to hit the `else` branch of `if (hex1 < 10)` and `if (hex2 < 10)`.
From 3f559329d9f10dfeda1e27b744d8cd8317a6b867 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 21 Jul 2026 04:27:20 +0000
Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM?=
=?UTF-8?q?]=20=EC=83=9D=EC=84=B1=EB=90=9C=20HTML=EC=9D=98=20CSP=20?=
=?UTF-8?q?=ED=95=B4=EC=8B=9C=20=EB=B6=88=EC=9D=BC=EC=B9=98=20=EC=98=A4?=
=?UTF-8?q?=EB=A5=98=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
๐จ Severity: MEDIUM
๐ก Vulnerability: CSP `style-src` ํด์๊ฐ์ด ์ค์ ` tags. When using string interpolation in Kotlin multiline strings, any surrounding whitespace inside the tags alters the final output, rendering the CSP hash invalid and blocking the style.
**Prevention:** When injecting content into a