🛡️ Sentinel: [MEDIUM] HTTP 예외 응답의 누락된 보안 헤더 추가

.jules/sentinel.md

@@ -90,3 +90,7 @@
 **Vulnerability:** The `_safe_upload_filename` function used `filename.replace`, `PurePosixPath`, and `re.sub` on unbounded client input, making it vulnerable to ReDoS or CPU/memory exhaustion (DoS) when fed extremely long strings.
 **Learning:** Even fast standard library functions like `PurePosixPath` and string replacements can cause significant lag when chained on strings in the megabytes. String processing operations should always bound their inputs first if the input is untrusted and can be arbitrarily large.
 **Prevention:** Cap the length of client-provided filename strings early by slicing them (e.g. `filename = filename[-512:]`) before doing more complex string parsing or regex replacements, especially when only the basename suffix is relevant.
+## 2025-02-27 - [MEDIUM] Missing Security Headers on FastAPI Exception Responses
+**Vulnerability:** HTTP exception responses (e.g. 404, 401, 422) raised by Starlette or FastAPI standard exceptions bypassed the custom `_apply_security_headers` middleware and global exception handler, leaking server information without strict security headers.
+**Learning:** Default framework exception handlers bypass application middlewares that inject headers into responses unless explicitly overridden to inject those headers manually.
+**Prevention:** Override `StarletteHTTPException` and `RequestValidationError` default exception handlers to always append security headers to error responses, regardless of response content or status body allowances.

src/newsdom_api/main.py

@@ -19,9 +19,13 @@
     Response,
     UploadFile,
 )
+from fastapi.encoders import jsonable_encoder
+from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse
 from fastapi.security import HTTPBearer
+from fastapi.utils import is_body_allowed_for_status_code
 from pypdf import PdfReader
+from starlette.exceptions import HTTPException as StarletteHTTPException
 from pypdf.errors import PdfReadError
 
 from .config import (
@@ -161,6 +165,36 @@ async def global_exception_handler(request: Request, exc: Exception) -> Response
     return _apply_security_headers(response, request)
 
 
+async def http_exception_handler(
+    request: Request, exc: StarletteHTTPException
+) -> Response:
+    """Return sanitized standard HTTP exceptions with security headers."""
+
+    if not is_body_allowed_for_status_code(exc.status_code):
+        response = Response(
+            status_code=exc.status_code, headers=getattr(exc, "headers", None)
+        )
+    else:
+        response = JSONResponse(
+            status_code=exc.status_code,
+            content={"detail": getattr(exc, "detail", "HTTP Exception")},
+            headers=getattr(exc, "headers", None),
+        )
+    return _apply_security_headers(response, request)
+
+
+async def validation_exception_handler(
+    request: Request, exc: RequestValidationError
+) -> Response:
+    """Return unprocessable entity responses with standard security headers."""
+
+    response = JSONResponse(
+        status_code=422,
+        content={"detail": jsonable_encoder(exc.errors())},
+    )
+    return _apply_security_headers(response, request)
+
+
 def health() -> HealthResponse:
     """Return a minimal liveness response independent from service readiness."""
 
@@ -329,6 +363,10 @@ def create_app(
     )
     application.middleware("http")(security_boundary_middleware)
     application.add_exception_handler(Exception, global_exception_handler)
+    application.add_exception_handler(StarletteHTTPException, http_exception_handler)
+    application.add_exception_handler(
+        RequestValidationError, validation_exception_handler
+    )
     application.add_api_route(
         "/health",
         health,

tests/test_security_headers_exceptions.py

@@ -0,0 +1,30 @@
+import pytest
+from fastapi.testclient import TestClient
+from starlette.exceptions import HTTPException as StarletteHTTPException
+from src.newsdom_api.config import RuntimeSettings, AuthenticationMode, RuntimeProfile
+from src.newsdom_api.main import create_app
+
+
+@pytest.fixture
+def test_client():
+    settings = RuntimeSettings(
+        api_token=None,
+        authentication_mode=AuthenticationMode.DISABLED,
+        runtime_profile=RuntimeProfile.DEVELOPMENT,
+    )
+    # Using real app router but we override readiness for testing
+    app = create_app(settings, runtime_readiness_probe=lambda: True)
+
+    # Add a dummy route that raises an exception with a status code that does not allow a body
+    @app.get("/no-content-exception")
+    def no_content_exception():
+        raise StarletteHTTPException(status_code=204)
+
+    return TestClient(app, raise_server_exceptions=False)
+
+
+def test_http_exception_no_body(test_client):
+    response = test_client.get("/no-content-exception")
+    assert response.status_code == 204
+    assert response.headers.get("x-content-type-options") == "nosniff"
+    assert response.content == b""