🛡️ Sentinel: [HIGH] Fix bcrypt DoS vulnerability

.github/workflows/osvscanner.yml

@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@v4
       - name: Run OSV-Scanner
-        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2
+        uses: google/osv-scanner-action/osv-scanner-action@v1.9.0
         with:
           scan-args: |-
             --recursive

packages/shared/src/schemas/auth.test.ts

@@ -19,6 +19,13 @@ describe('LoginRequestSchema', () => {
       LoginRequestSchema.safeParse({ email: 'a@b.com', password: '1234567' }).success,
     ).toBe(false)
   })
+
+  it('비밀번호가 1025자 이상이면 실패한다 (max 1024 경계)', () => {
+    const longPassword = 'a'.repeat(1025)
+    expect(
+      LoginRequestSchema.safeParse({ email: 'a@b.com', password: longPassword }).success,
+    ).toBe(false)
+  })
 })
 
 describe('RegisterRequestSchema', () => {
@@ -33,6 +40,13 @@ describe('RegisterRequestSchema', () => {
       RegisterRequestSchema.safeParse({ email: 'a@b.com', password: '12345678', name: 'k' }).success,
     ).toBe(true)
   })
+
+  it('비밀번호가 1025자 이상이면 실패한다 (max 1024 경계)', () => {
+    const longPassword = 'a'.repeat(1025)
+    expect(
+      RegisterRequestSchema.safeParse({ email: 'a@b.com', password: longPassword, name: 'k' }).success,
+    ).toBe(false)
+  })
 })
 
 describe('ExchangeRequestSchema', () => {

packages/shared/src/schemas/auth.ts

@@ -2,12 +2,12 @@ import { z } from 'zod'
 
 export const LoginRequestSchema = z.object({
   email: z.string().email(),
-  password: z.string().min(8),
+  password: z.string().min(8).max(1024),
 })
 
 export const RegisterRequestSchema = z.object({
   email: z.string().email(),
-  password: z.string().min(8),
+  password: z.string().min(8).max(1024),
   name: z.string().min(1),
 })
 

packages/web/src/app/api/password-reset/[token]/route.ts

@@ -12,8 +12,8 @@ export const dynamic = 'force-dynamic'
 
 const ResetPasswordSchema = z
   .object({
-    password: z.string().min(8),
-    passwordConfirmation: z.string().min(8),
+    password: z.string().min(8).max(1024),
+    passwordConfirmation: z.string().min(8).max(1024),
   })
   .refine((value) => value.password === value.passwordConfirmation, {
     path: ['passwordConfirmation'],