From dcf4da4371d5a0e77b8de73fede89d3340448092 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sat, 11 Jul 2026 17:15:04 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20SS?=
 =?UTF-8?q?RF=20=EC=9A=B0=ED=9A=8C=20=EC=B7=A8=EC=95=BD=EC=A0=90=20?=
 =?UTF-8?q?=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: HIGH
💡 Vulnerability: `urllib.request.urlopen`이 리다이렉트를 기본적으로 따라가며, 이를 방지하기 위한 `NoRedirectHandler`가 `HTTPErrorProcessor`를 상속받아 구현되어 있었습니다. 이는 리다이렉트는 막지만, 401이나 404, 500과 같은 다른 모든 HTTP 에러를 억제하여 성공한 응답으로 처리하는 부작용이 있었습니다.
🎯 Impact: 올바른 HTTP 상태 코드가 무시되어 예기치 않은 동작이나 보안 검증 우회가 발생할 수 있습니다.
🔧 Fix: `NoRedirectHandler`가 `urllib.request.HTTPRedirectHandler`를 상속받도록 변경하고, 리다이렉트 발생 시 명시적으로 `urllib.error.HTTPError`를 발생시키도록 수정했습니다.
✅ Verification: 단위 테스트 추가 및 `pytest` 통과, 100% 테스트 커버리지 달성을 확인했습니다.
---
 scripts/ci/sandboxed_web_e2e.py | 10 ++++------
 tests/test_sandboxed_web_e2e.py | 14 +++++++-------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index 682202fa..506cc044 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -26,14 +26,12 @@
 RESULT_MARKER = "SANDBOXED_WEB_E2E_RESULT"
 
 
-class NoRedirectHandler(urllib.request.HTTPErrorProcessor):
+class NoRedirectHandler(urllib.request.HTTPRedirectHandler):
     """Explicitly disable redirects to prevent SSRF bypasses via 301/302 to local IPs."""
 
-    def http_response(self, request, response):
-        """Return the original HTTP response without following redirects."""
-        return response
-
-    https_response = http_response
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        """Raise an HTTPError instead of following the redirect."""
+        raise urllib.error.HTTPError(req.full_url, code, msg, headers, fp)
 
 
 @dataclass
diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py
index 38f5f8bf..7bd9a2a8 100644
--- a/tests/test_sandboxed_web_e2e.py
+++ b/tests/test_sandboxed_web_e2e.py
@@ -228,16 +228,16 @@ def open(self, url, timeout):
     assert sandboxed_web_e2e.tail_text(log_path).splitlines()[0] == "line-10"
 
 
-def test_no_redirect_handler_returns_redirect_without_following():
-    """Readiness checks must not follow redirects to attacker-controlled internal URLs."""
-
-    class RedirectResponse:
-        status = 302
+def test_no_redirect_handler_raises_httperror_without_following():
+    """Readiness checks must raise HTTPError on redirects to prevent attacker-controlled internal URLs."""
+    import urllib.error
 
     request = sandboxed_web_e2e.urllib.request.Request("https://example.test/ready")
-    response = RedirectResponse()
 
-    assert sandboxed_web_e2e.NoRedirectHandler().http_response(request, response) is response
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        sandboxed_web_e2e.NoRedirectHandler().redirect_request(request, None, 302, "Found", {}, "http://127.0.0.1")
+
+    assert exc_info.value.code == 302
 
 
 def test_wait_for_url_returns_false_after_timeout(monkeypatch, tmp_path):