🛡️ Sentinel: [CRITICAL] HMAC 예외 처리 누락으로 인한 DoS 취약점 수정

[seonghobae]

🚨 심각도: CRITICAL
💡 취약점: 사용자가 제공한 x-api-key 헤더에 비 ASCII 문자가 포함된 경우, hmac.compare_digest에서 TypeError가 발생하여 Unhandled Exception으로 인한 서비스 거부(DoS)가 발생합니다.
🎯 영향: 공격자가 임의의 비 ASCII 문자가 포함된 HTTP 헤더를 전송하여 웹 서버 프로세스를 강제 종료시키거나 서비스 장애를 유발할 수 있습니다.
🔧 작업 내용: hmac.compare_digest 호출 전에 제공된 키와 설정된 키를 명시적으로 바이트 형식으로 인코딩(latin1 및 utf-8)하도록 수정했습니다.
✅ 검증: 비 ASCII 문자가 포함된 API 키로 요청을 보낼 때 서버가 다운되지 않고 정상적으로 401 Unauthorized 에러를 반환하는지 확인하는 테스트를 추가했습니다.

---

PR created automatically by Jules for task 9404584076038914036 started by @seonghobae

Summary by CodeRabbit

• 버그 수정
  • 비 ASCII 문자가 포함된 API 키 헤더로 인증을 시도할 때 발생할 수 있는 오류를 방지했습니다.
  • 유효하지 않은 API 키 요청은 오류 대신 401 응답을 반환합니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 891060b4-dd09-4eb6-89ee-20a40b2af6d1

---

📥 Commits

Reviewing files that changed from the base of the PR and between 47c6fd2 and 55d5a92.

---

📒 Files selected for processing (3)

• .jules/sentinel.md
• saas_web.py
• tests/test_saas_web.py

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

require_api_key가 헤더와 설정된 API 키를 바이트로 인코딩한 뒤 비교합니다. 한글 헤더가 포함된 요청에 401을 반환하는 테스트와 인코딩 지침을 추가했습니다.

Changes

API 키 검증

Layer / File(s)	Summary
바이트 비교와 회귀 테스트 saas_web.py, tests/test_saas_web.py, .jules/sentinel.md	require_api_key는 헤더를 Latin-1, 설정된 키를 UTF-8로 인코딩해 비교합니다. 한글 API 키 헤더를 포함한 /jobs 요청이 401을 반환하는 테스트를 추가했습니다. 문서에는 비 ASCII 문자열 비교 시 발생할 수 있는 TypeError와 인코딩 지침을 기록했습니다.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

---

Merge Risk: ⚪ Minimal · up to bdc52

API-key comparison now uses bytes, and the tested non-ASCII request expects a 401 response. No actionable merge-blocking risk remains.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		제목은 HMAC 예외로 인한 DoS 취약점 수정이라는 주요 변경 사항을 명확히 설명합니다.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 unsupported.)

---

---

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}