🛡️ Sentinel: [HIGH] 심각도 및 카테고리 처리의 프로토타입 오염 및 DOM XSS 위험 수정

.jules/sentinel.md

@@ -127,3 +127,8 @@
 **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
 **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
 **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+
+## 2026-08-05 - [DOM XSS and Prototype Pollution via Object literals in Dashboard]
+**Vulnerability:** DOM XSS and Prototype Pollution via unescaped dictionary lookup keys like `severity` and `category` injected into maps configured as `{}`.
+**Learning:** Using `{}` constructs a JavaScript object that inherits from `Object.prototype`. If an attacker supplies keys like `__proto__` or `constructor` via user-controlled strings (e.g. `findings.json`), property lookups (like `SEV[f.severity]`) will access native prototype properties instead of undefined map entries. Coercing these native functions to strings results in outputs like `function Object() { [native code] }`, breaking rendering logic, causing DOM XSS if injected into `innerHTML` sinks, and polluting application state. Using `.toUpperCase()` does not neutralize this, as properties like `__PROTO__` may still cause undefined behaviors or prototype interference in certain engines, and `constructor` remains dangerous regardless of casing.
+**Prevention:** Always create dictionaries designed to store arbitrary user-provided keys using `Object.create(null)` to ensure a null prototype. Additionally, when using user input as a key to look up statically defined safe values, explicitly validate the key exists directly on the object using `Object.hasOwn(obj, key)` rather than relying on loose lookups or the `in` operator, which traverses the prototype chain.

scanner/dashboard/console.html

@@ -76,7 +76,7 @@ <h1>AppGuardrail Console</h1>
 <script>
 const $=s=>document.querySelector(s);
 const esc=s=>String(s==null?"":s).replace(/[&<>"']/g,c=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[c]));
-const SEV={CRITICAL:"var(--crit)",HIGH:"var(--high)",WARNING:"var(--warn)",INFO:"var(--info)"};
+const SEV=Object.assign(Object.create(null), {CRITICAL:"var(--crit)",HIGH:"var(--high)",WARNING:"var(--warn)",INFO:"var(--info)"});
 let KEY=sessionStorage.getItem("ag_key")||"";
 let currentDetailRequest=0;
 let lastDetailFocus=null;
@@ -155,7 +155,7 @@ <h1>AppGuardrail Console</h1>
   try{
     const s=await api("/api/v1/scans/"+id);
     if(requestId!==currentDetailRequest)return;
-    const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[f.severity]||'var(--info)'}">${esc(f.severity)}</span></td>
+    const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[Object.hasOwn(SEV, f.severity) ? f.severity : 'INFO']||'var(--info)'}">${esc(f.severity)}</span></td>
       <td><code>${esc(f.rule_id)}</code></td><td>${esc((f.message||"").split("\n")[0].slice(0,120))}</td>
       <td><code>${esc(f.file)}:${esc(f.line)}</code></td></tr>`).join("");
     d.innerHTML=`<button type="button" class="close-btn" aria-label="Close details">✕</button><strong>Scan #${esc(s.id)}</strong> <span class="muted">${esc(s.created_at)} · ${esc(s.repo||"—")}</span>

scanner/dashboard/index.html

@@ -169,12 +169,12 @@ <h1>Clean scan</h1>
     browseFindings.addEventListener('click', () => fileInput.click());
     return;
   }
-  const counts = {CRITICAL:0,HIGH:0,WARNING:0,INFO:0};
-  const byCat = {};
+  const counts = Object.assign(Object.create(null), {CRITICAL:0,HIGH:0,WARNING:0,INFO:0});
+  const byCat = Object.create(null);
   let blocking = 0;
   for(const f of ALL){
     const s = String(f.severity||'INFO').toUpperCase();
-    counts[s in counts ? s : 'INFO']++;
+    counts[Object.hasOwn(counts, s) ? s : 'INFO']++;
     const c = String(f.category||'misconfig');
     byCat[c] = (byCat[c]||0)+1;
     if(isDeployBlocking(f)) blocking++;

tests/test_dashboard_status_contracts.py

@@ -82,7 +82,7 @@ def test_dashboard_distinguishes_unloaded_and_clean_scan_states() -> None:
 
     unloaded = html.index("if(!ALL){")
     clean = html.index("if(ALL.length === 0){")
-    populated = html.index("const counts = {CRITICAL:0,HIGH:0,WARNING:0,INFO:0};")
+    populated = html.index("const counts = Object.assign(Object.create(null), {CRITICAL:0,HIGH:0,WARNING:0,INFO:0});")
 
     assert unloaded < clean < populated
     assert "<h1>Clean scan</h1>" in html