🛡️ Sentinel: [CRITICAL] DDL 생성 중 SQL 인젝션 취약점 수정

[seonghobae]

🚨 Severity: CRITICAL

💡 Vulnerability

ERD 도구(packages/web/src/lib/erd.ts)의 DDL 생성 기능에서, 컬럼 타입(column.type) 값에 대한 검증이 부족하여 사용자가 의도적으로 세미콜론(;) 등을 주입해 여러 개의 악의적인 SQL 문을 실행하도록 조작할 수 있었습니다 (예: integer; DROP TABLE users;).

🎯 Impact

DDL문 조립 시 연결(concatenate)되는 입력값이 직접적으로 스키마 생성 쿼리에 반영되어, 악의적인 사용자가 다른 테이블을 삭제하거나 권한 없는 작업을 실행하는 등 커맨드 인젝션 및 SQL 인젝션 공격이 가능합니다.

🔧 Fix

addColumn 함수 내부에서 column.type에 구문 종료를 의미하는 세미콜론(;)이 포함되어 있는지 검사하고, 포함되어 있다면 Error("Column type cannot contain semicolons.")를 발생시켜 사전에 차단하도록 로직을 추가했습니다.

✅ Verification

packages/web/src/lib/erd.test.ts에 세미콜론이 포함된 컬럼 타입을 추가하려고 시도할 때 에러가 발생하는지 확인하는 테스트(should throw when adding a column with a semicolon in the type)를 추가하여, vitest로 100% 코드 커버리지를 통과함을 확인했습니다.

---

PR created automatically by Jules for task 9102675331465230178 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

ERD DDL 생성 로직에서 사용자 제공 column.type이 그대로 DDL 문자열에 합쳐지며 발생할 수 있는 SQL 인젝션 위험을 완화하기 위한 PR입니다.

Changes:

• ERDModel.addColumn()에서 column.type에 세미콜론(;) 포함 여부를 검사해 차단 로직 추가
• 관련 보안 회귀 테스트(column.type에 세미콜론 포함 시 throw) 추가
• Sentinel 문서에 본 취약점/학습/예방 항목 추가

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
packages/web/src/lib/erd.ts	column.type 입력 검증을 추가해 DDL 조립 시 악성 입력을 일부 차단
packages/web/src/lib/erd.test.ts	세미콜론 주입 시 예외가 발생하는지 검증하는 테스트 추가
.jules/sentinel.md	취약점 포스트모템/재발방지 기록 추가

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seonghobae]

Closing as superseded by #334. This PR only blocks semicolons and still leaves the review-identified DDL injection avenues (SQL comments/newlines and sibling clauses via top-level commas) unresolved; its exact head also has failing OSV-Scanner, Security Scan, and SAST Semgrep runs. PR #334 now carries test-first coverage for top-level comma/comment/unbalanced-parenthesis payloads plus a constrained SQL-type grammar that still permits legitimate forms such as numeric(10,2) and multi-word timestamp types. Keeping both branches open would create competing repairs for the same ERD security gap.

[google-labs-jules]

Closing as superseded by #334. This PR only blocks semicolons and still leaves the review-identified DDL injection avenues (SQL comments/newlines and sibling clauses via top-level commas) unresolved; its exact head also has failing OSV-Scanner, Security Scan, and SAST Semgrep runs. PR #334 now carries test-first coverage for top-level comma/comment/unbalanced-parenthesis payloads plus a constrained SQL-type grammar that still permits legitimate forms such as numeric(10,2) and multi-word timestamp types. Keeping both branches open would create competing repairs for the same ERD security gap.

Understood. Acknowledging that this work is now superseded by #334 and stopping work on this task.