🛡️ Sentinel: [HIGH] hmac.compare_digest TypeError DoS 취약점 수정

[seonghobae]

🚨 심각도: HIGH
💡 취약점: hmac.compare_digest() 함수에 비-ASCII(Non-ASCII) 문자가 포함된 문자열을 전달할 때 발생하는 TypeError로 인한 서비스 거부(DoS) 취약점 (CWE-400 / CWE-754).
🎯 영향: 공격자가 HTTP 헤더(예: X-API-Key)에 의도적으로 한글 등 비-ASCII 문자를 전송하면 FastAPI 미들웨어에서 TypeError 예외가 발생하고 이를 처리하지 못해 500 Internal Server Error 상태가 됩니다. 지속적인 공격은 서버 리소스를 낭비하고 정상적인 요청 처리를 방해하여 애플리케이션의 DoS를 유발할 수 있습니다.
🔧 해결책: saas_web.py 미들웨어에서 제공된 키와 설정된 키를 hmac.compare_digest()로 비교하기 전에 .encode("latin1") (제공된 키, Starlette 기본 디코딩) 및 .encode("utf-8") (설정된 키)을 사용하여 안전하게 바이트(bytes)로 변환하도록 수정했습니다.
✅ 검증: 한글 키를 사용해 X-API-Key 헤더를 전송할 때 500 오류가 발생하지 않고 올바른 응답 또는 401 권한 없음 오류를 반환하는지 확인하는 단위 테스트를 추가하고 통과시켰습니다.

---

PR created automatically by Jules for task 3875179072510415708 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 08dc954f-0883-4e2d-b6b8-b23dec5e2cc6

📥 Commits

Reviewing files that changed from the base of the PR and between 47c6fd2 and a4369a5.

📒 Files selected for processing (3)

• .jules/sentinel.md
• saas_web.py
• tests/test_saas_web.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}