🛡️ Sentinel: [HIGH] Fix DoS via unhandled exception in hmac.compare_digest

[seonghobae]

🚨 Severity: HIGH
💡 Vulnerability: hmac.compare_digest에 ASCII가 아닌 문자(예: 한국어 등)가 포함된 Authorization 헤더가 입력되면 TypeError가 발생하여, 예외 처리되지 않은 500 Internal Server Error를 유발합니다. 이는 인증 프로세스에 대한 DoS 공격(서비스 거부)을 가능하게 합니다.
🎯 Impact: 악의적인 사용자가 특수문자나 비영어 문자가 포함된 토큰을 지속적으로 보내어 서버의 리소스를 소모하거나 에러를 유발하여 서비스를 중단시킬 수 있습니다.
🔧 Fix: 입력받은 문자열(제공된 토큰과 예상 토큰)을 비교하기 전에 명시적으로 utf-8 바이트로 인코딩(encode("utf-8"))하도록 수정하였습니다.
✅ Verification: 테스트 스위트(uv run pytest)가 성공적으로 통과하며, 비-ASCII 헤더 요청 시 500 에러 대신 올바르게 401(또는 기타 적절한 응답)이 반환됩니다.

What:
hmac.compare_digest 호출 전에 비교할 두 문자열(provided 및 expected)을 모두 utf-8 바이트 배열로 변환하는 과정을 추가했습니다.

Why:
Python의 hmac.compare_digest는 비-ASCII 문자가 포함된 문자열 처리를 지원하지 않아 TypeError가 발생합니다. 외부 입력은 항상 신뢰할 수 없으므로, 이를 바이트로 인코딩하여 시스템 안전성을 확보해야 합니다.

Before/After:

• Before: 비-ASCII 문자가 포함된 토큰 입력 시 서버가 500 Internal Server Error 발생.
• After: 비-ASCII 문자가 포함된 토큰 입력 시 401 Unauthorized 에러 등을 정상적으로 반환하며 서버가 안정적으로 동작함.

Accessibility/DX:
보안 안정성이 향상되어, 인증 관련 에러로 인한 서비스 중단 없이 안정적인 운영 환경을 제공합니다.

---

PR created automatically by Jules for task 17379201691801903708 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[Copilot]

Pull request overview

This PR hardens the optional bearer-auth gate by preventing hmac.compare_digest from raising TypeError on non-ASCII Authorization header values, eliminating a potential DoS via unhandled 500s in the auth path.

Changes:

• Encode both the provided and expected bearer strings to UTF-8 bytes before calling hmac.compare_digest.
• Add a regression test that sends a non-ASCII Authorization header and asserts a clean 401 Unauthorized.
• Document the security fix in the Sentinel log and the changelog (though the changelog entry is currently placed in the wrong section).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/newsdom_api/main.py	Encodes auth strings to bytes before constant-time comparison to avoid non-ASCII TypeError.
tests/test_auth.py	Adds coverage to ensure non-ASCII Authorization headers don’t trigger a 500.
CHANGELOG.md	Adds a “Fixed” entry for the DoS issue (currently appended after reference links).
.jules/sentinel.md	Records the vulnerability, learning, and prevention guidance for this class of issue.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8ee3b7ab-e42d-43a3-b6fa-84adcd35a549

📥 Commits

Reviewing files that changed from the base of the PR and between 04491c0 and 0eaf7f1.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .jules/sentinel.md
• .trivyignore
• CHANGELOG.md
• src/newsdom_api/main.py
• tests/test_auth.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel-fix-hmac-dos-17379201691801903708

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

CHANGELOG.md:105

• This changelog entry is appended after the link reference definitions ([Unreleased]: ..., [0.2.0]: ...), so it’s no longer part of any release/Unreleased section and breaks the expected Keep-a-Changelog structure. Please move this bullet under the appropriate section (likely ## [Unreleased] → ### Fixed or ### Security) and keep the link references as the final lines of the file.

### Fixed
- `hmac.compare_digest`에 비-ASCII 문자가 포함된 `Authorization` 헤더가 입력될 때 발생하는 500 에러 및 잠재적 DoS 취약점을 수정했습니다.