changukyu 4ef12f5f95 feat: HTTP security hardening (CSP, CSRF, session tag, body caps) ... - Trusted app-shell responses now carry a strict script-src CSP plus X-Frame-Options: DENY and nosniff (img-src stays permissive for external evidence thumbnails; the GUI uses no inline scripts). - Session cookie stores an HMAC-derived tag, not the raw COPYRIGHTER_AUTH_TOKEN, so a leaked cookie no longer reveals the token/bearer/.env secret. - Cookie-authenticated state-changing requests require a same-origin Origin/Referer (CSRF); header-authenticated requests are not forgeable. - _body rejects negative/non-integer Content-Length (was reaching rfile.read(-1), an unbounded read-to-EOF) and returns a controlled 400. - Handler timeout=30 bounds slow-client thread exhaustion; uploads use exclusive-create ('xb') to close a concurrent same-name overwrite TOCTOU. Tests: app-shell security headers, negative Content-Length -> 400, cookie tag (not raw token), cookie-authed cross-origin POST -> 403 / same-origin -> 200.		2026-07-11 16:07:13 +09:00
..
operator_gui	test: add Playwright E2E harness for operator GUI with decision-flow spec	2026-06-21 21:10:22 +09:00
rights_filter	feat: HTTP security hardening (CSP, CSRF, session tag, body caps)	2026-07-11 16:07:13 +09:00