🛡️ Sentinel: [HIGH] hmac.compare_digest 비-ASCII 문자열 처리 중 발생하는 DoS 취약점 수정

.jules/sentinel.md

@@ -65,3 +65,8 @@
 **Vulnerability:** Path traversal in `media_shrinker.py` via unresolved `..` segments or symlink escapes before deriving conversion output paths.
 **Learning:** `Path.relative_to()` is only a lexical containment check unless both the source and root have first been resolved into canonical absolute paths. Relative paths and symlinks can otherwise bypass root-boundary assumptions.
 **Prevention:** Resolve both source and root once, reject sources outside the resolved root with a sanitized `MediaShrinkerError`, and derive `rel_source` from the resolved paths before planning outputs.
+
+## 2024-08-14 - hmac.compare_digest 비-ASCII DoS 취약점
+**Vulnerability:** HTTP 헤더(x-api-key)에 비-ASCII 문자가 포함될 때 `hmac.compare_digest`가 `TypeError`를 발생시켜 서버 에러(500) 및 DoS 취약점 유발.
+**Learning:** Python의 `hmac.compare_digest`는 비-ASCII 문자가 포함된 문자열 비교를 지원하지 않는다.
+**Prevention:** `hmac.compare_digest`에 사용자 입력을 전달하기 전에 항상 `.encode('utf-8')`을 사용하여 바이트로 명시적 인코딩을 수행해야 한다.

saas_web.py

@@ -113,8 +113,9 @@ async def require_api_key(request: Request, call_next):
     configured_keys = get_configured_api_keys()
     if configured_keys and not (request.method == "GET" and request.url.path == "/"):
         provided_key = request.headers.get("x-api-key", "")
+        provided_key_bytes = provided_key.encode("utf-8")
         if not any(
-            hmac.compare_digest(provided_key, key) for key in configured_keys
+            hmac.compare_digest(provided_key_bytes, key.encode("utf-8")) for key in configured_keys
         ):
             return JSONResponse(
                 status_code=401,

tests/test_saas_web.py

@@ -707,6 +707,29 @@ def test_missing_header_rejected_when_keys_configured(self):
         self.assertEqual(response.json(), {"error": "Invalid or missing API key"})
         self.assertNotIn("secret-key", response.text)
 
+    def test_non_ascii_key_handled_safely(self):
+        # We must bypass the TestClient for this test because TestClient/httpx natively
+        # rejects non-ASCII headers. We want to ensure the middleware itself doesn't crash.
+        import starlette.requests
+        from saas_web import require_api_key
+        import asyncio
+
+        async def mock_call_next(request):
+            return "SUCCESS"
+
+        scope = {
+            'type': 'http',
+            'method': 'GET',
+            'path': '/api/foo',
+            'headers': [(b'x-api-key', 'non-ascii🎉'.encode('utf-8'))]
+        }
+        request = starlette.requests.Request(scope)
+
+        with patch.dict(os.environ, {"CODEC_CARVER_API_KEYS": "secret-key"}):
+            response = asyncio.run(require_api_key(request, mock_call_next))
+
+        self.assertEqual(response.status_code, 401)
+
     def test_wrong_key_rejected(self):
         with patch.dict(os.environ, {"CODEC_CARVER_API_KEYS": "secret-key"}):
             response = self._post_shrink(headers={"X-API-Key": "wrong-key"})