🛡️ Sentinel: [HIGH] Fix bcrypt DoS vulnerability

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: Zod schemas validation lacking an upper bound limits string length on password. Excessively long strings provided by attackers to password endpoints can lead to high CPU consumption due to bcrypt's O(N) complexity for hashing strings. This results in CPU exhaustion and Denial of Service (DoS).
🎯 Impact: An unauthenticated user could send a massive payload causing high server load and ultimately denial of service.
🔧 Fix: Enforced a 1024 maximum string length limit on all password and passwordConfirmation fields across LoginRequestSchema, RegisterRequestSchema, and ResetPasswordSchema.
✅ Verification: Verified by checking out the branch and running pnpm test --recursive, ensuring that maximum boundary checks are correctly failing as implemented in the tests.

테스트 커버리지를 100%로 유지하기 위해 .max() 제한을 테스트하는 코드를 auth.test.ts에 추가하였습니다.

---

PR created automatically by Jules for task 7606841181251485844 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

Addresses a high-severity bcrypt CPU-exhaustion (DoS) risk by bounding password string length during request validation, so oversized payloads are rejected before hashing in auth/password-reset flows.

Changes:

• Added z.string().max(1024) to password (and reset passwordConfirmation) validation.
• Added unit tests to ensure >1024-length passwords fail validation for login/register schemas.
• Updated password reset API route validation to enforce the same maximum length.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
packages/web/src/app/api/password-reset/[token]/route.ts	Adds max-length validation to password reset POST payload schema.
packages/shared/src/schemas/auth.ts	Adds max-length validation to shared login/register request schemas.
packages/shared/src/schemas/auth.test.ts	Adds boundary tests ensuring overly long passwords are rejected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

package.json:27

• pnpm.overrides에서 동일 패키지에 대해 서로 다른 버전을 동시에 강제하고 있습니다(예: hono: 4.12.25 vs 아래의 <4.12.27 범위 오버라이드에서 4.12.27, js-yaml: 4.2.0 vs js-yaml@>=4.0.0 <4.3.0: 4.3.0). 또한 minimatch@3.1.5>brace-expansion을 1.1.11로 고정하면서 brace-expansion@<1.1.16: 1.1.16 오버라이드를 무력화해 lockfile에서 brace-expansion이 1.1.15 → 1.1.11로 다운그레이드됩니다.

해결: 상충하는 기본 오버라이드 값을 실제 의도(현재 lockfile에서 선택된 버전)에 맞게 정렬하고, minimatch@3.1.5>brace-expansion은 최소한 1.1.16으로 올린 뒤 lockfile을 재생성해 주세요.

      "hono": "4.12.25",
      "js-yaml": "4.2.0",
      "minimatch@3.1.5>brace-expansion": "1.1.11",
      "brace-expansion@<1.1.16": "1.1.16",
      "brace-expansion@>=3.0.0 <5.0.7": "5.0.7",

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (4)

packages/shared/src/schemas/auth.test.ts:28

• auth.test.ts에서 max 경계 테스트가 1025자 실패만 확인하고 있어, 1024자(허용값)가 실제로 통과하는지 검증되지 않습니다. off-by-one 회귀를 막기 위해 1024자 성공 케이스도 같은 테스트에서 함께 확인하는 편이 안전합니다.

  it('비밀번호가 1025자 이상이면 실패한다 (max 1024 경계)', () => {
    const longPassword = 'a'.repeat(1025)
    expect(
      LoginRequestSchema.safeParse({ email: 'a@b.com', password: longPassword }).success,
    ).toBe(false)
  })

packages/shared/src/schemas/auth.test.ts:49

• auth.test.ts의 RegisterRequestSchema max 경계 테스트도 1025자 실패만 확인하고 있어, 1024자(허용값)가 통과하는지 검증되지 않습니다. 1024자 성공 케이스를 추가해 경계 조건을 명확히 테스트하는 것이 좋습니다.

  it('비밀번호가 1025자 이상이면 실패한다 (max 1024 경계)', () => {
    const longPassword = 'a'.repeat(1025)
    expect(
      RegisterRequestSchema.safeParse({ email: 'a@b.com', password: longPassword, name: 'k' }).success,
    ).toBe(false)
  })

packages/shared/src/schemas/auth.ts:11

• 동일한 max(1024) 값이 shared 스키마와 web 라우트 스키마에 중복으로 하드코딩되어 있어(드리프트 위험), 상수(예: PASSWORD_MAX_LENGTH)로 정의해 재사용하는 편이 유지보수에 유리합니다.

export const LoginRequestSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).max(1024),
})

export const RegisterRequestSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).max(1024),
  name: z.string().min(1),

packages/web/src/app/api/password-reset/[token]/route.ts:17

• ResetPasswordSchema에 max 길이 제한이 추가되었지만, packages/web 쪽에서는 해당 라우트에 대한 테스트가 없어(예: 1024자 통과/1025자 실패 및 400 VALIDATION_ERROR 응답) 회귀를 잡기 어렵습니다. packages/web/src/app/api/password-reset/[token]/route.test.ts 같은 형태로 라우트 레벨 테스트를 추가하는 것을 권장합니다.

const ResetPasswordSchema = z
  .object({
    password: z.string().min(8).max(1024),
    passwordConfirmation: z.string().min(8).max(1024),
  })