security(ignore): preserve fail-closed sibling pending canonical TOCTOU repair

[seonghobae]

이 PR의 fail-closed 방향은 유효하지만 현재 evidence만으로 CRITICAL exploit chain이나 TOCTOU closure를 주장하지 않습니다.

현재 exact head: 2383eb6a9cdd571bd4d3dbb4a09450f76aac3d30.

Sibling ownership

#761이 같은 protected master@728f0f33323e43573d6664209891099502827d5d에서 더 강한 canonical repair/evidence lane을 유지하고 있습니다. #761은 broken symlink와 unsafe policy-file 상태를 fail-closed 하는 현재 delta를 보존하면서, pathname validation 뒤 useLines에서 같은 path를 다시 resolve/open하는 잔존 TOCTOU를 명시하고 deterministic swap RED → single-open/no-follow handle GREEN을 acceptance로 갖습니다.

이 #768 branch는 IgnoreFileReadException과 directory skip semantics를 갖지만, patch 기준으로 여전히 pathname 검사와 이후 읽기 사이의 object identity를 고정하지 못합니다. 따라서 #761이 exact-head GREEN/merge를 완료하고 이 branch의 유효 fail-closed semantic delta/test evidence를 완전히 승계했다고 검증되기 전에는 단순 Close하지 않습니다. 반대로 #768을 Ready/merge해 #761의 stronger acceptance를 우회하지도 않습니다.

Severity boundary

현재 입증된 것은 unsafe .html4ignore 상태에서 디렉터리 publication을 fail closed하도록 하는 hardening 필요성과 잔존 race입니다. 로컬 entry mutation capability가 실제 privilege differential 및 민감 데이터 외부 노출로 이어지는 배포 exploit chain은 확인되지 않았으므로 severity를 확정하지 않습니다.

Promotion acceptance

• #761과 semantic/test delta를 대조해 누락된 유효 계약이 있으면 ordinary descendant 또는 canonical sibling으로 이전
• deterministic policy-entry replacement RED
• single-open/no-follow opened-handle authority와 실제 byte/read/decode/line/pattern limit GREEN
• current exact-head focused/full tests, JaCoCo, security/SAST/CodeQL terminal evidence
• security: make .html4ignore reads single-open and fail-closed #761 merge 후 successor가 이 PR의 유효 semantic delta/test/fixture/evidence를 완전히 승계했는지 확인한 뒤에만 PR-0 처리

force push, destructive rebase, self-approval, gate weakening, source-neutral rerun은 사용하지 않습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}