fix(security): 전체 서비스 보안 점검 — XSS·인가·토큰·헤더·에러마스킹 일괄 수정

Phase 1 CRITICAL XSS:
- marked.parse() → DOMPurify.sanitize() (system3 ai-assistant, issues-management)
- toast innerHTML에 escapeHtml 적용 (system1 api-base, system3 common-header)
- onclick 핸들러 → data 속성 + addEventListener (system2 issue-detail)

Phase 2 HIGH 인가:
- getUserBalance 본인확인 추가 (tksupport vacationController)

Phase 3 HIGH 토큰+CSP:
- localStorage 토큰 저장 제거 — 쿠키 전용 (7개 서비스)
- unsafe-eval CSP 제거 (system1 security.js)

Phase 4 MEDIUM:
- nginx 보안 헤더 추가 (8개 서비스)
- 500 에러 메시지 마스킹 (5개 API)
- path traversal 방지 (system3 file_service.py)
- cookie fallback 데드코드 제거 (4개 auth.js)
- /login/form rate limiting 추가 (sso-auth)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

system1-factory/api/config/security.js

@@ -19,7 +19,7 @@ const helmetOptions = {
     directives: {
       defaultSrc: ["'self'"],
       styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-      scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"], // 개발 중 unsafe-eval 허용
+      scriptSrc: ["'self'", "'unsafe-inline'"],
       imgSrc: ["'self'", "data:", "https:", "blob:"],
       fontSrc: ["'self'", "https://fonts.gstatic.com"],
       connectSrc: ["'self'", "https://api.technicalkorea.com"],

system1-factory/web/index.html

@@ -10,7 +10,7 @@
   if('serviceWorker' in navigator){navigator.serviceWorker.getRegistrations().then(function(r){r.forEach(function(reg){reg.unregister()});})}
   if('caches' in window){caches.keys().then(function(k){k.forEach(function(key){caches.delete(key)})})}
   </script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script>
     // SSO 토큰 확인
     var token = window.getSSOToken ? window.getSSOToken() : (localStorage.getItem('sso_token') || localStorage.getItem('token'));

system1-factory/web/js/api-base.js

@@ -193,7 +193,7 @@ if ('caches' in window) {
     var iconMap = { success: '\u2705', error: '\u274C', warning: '\u26A0\uFE0F', info: '\u2139\uFE0F' };
     var toast = document.createElement('div');
     toast.className = 'toast toast-' + type;
-    toast.innerHTML = '<span class="toast-icon">' + (iconMap[type] || '\u2139\uFE0F') + '</span><span class="toast-message">' + message + '</span>';
+    toast.innerHTML = '<span class="toast-icon">' + (iconMap[type] || '\u2139\uFE0F') + '</span><span class="toast-message">' + escapeHtml(message) + '</span>';
     container.appendChild(toast);
 
     setTimeout(function() { toast.classList.add('show'); }, 10);

system1-factory/web/js/auth.js

@@ -20,7 +20,7 @@ export function parseJwt(token) {
  */
 export function getToken() {
   if (window.getSSOToken) return window.getSSOToken();
-  return localStorage.getItem('sso_token');
+  return null;
 }
 
 /**
@@ -28,12 +28,7 @@ export function getToken() {
  */
 export function getUser() {
   if (window.getSSOUser) return window.getSSOUser();
-  const raw = localStorage.getItem('sso_user');
-  try {
-    return raw ? JSON.parse(raw) : null;
-  } catch(e) {
-    return null;
-  }
+  return null;
 }
 
 /**
@@ -41,8 +36,7 @@ export function getUser() {
  * sso_token/sso_user 키로 저장합니다.
  */
 export function saveAuthData(token, user) {
-  localStorage.setItem('sso_token', token);
-  localStorage.setItem('sso_user', JSON.stringify(user));
+  // 쿠키 기반 인증 — localStorage 저장 불필요 (gateway에서 쿠키 설정)
 }
 
 /**
@@ -50,9 +44,6 @@ export function saveAuthData(token, user) {
  */
 export function clearAuthData() {
   if (window.clearSSOAuth) { window.clearSSOAuth(); return; }
-  localStorage.removeItem('sso_token');
-  localStorage.removeItem('sso_user');
-  localStorage.removeItem('userPageAccess');
 }
 
 /**

system1-factory/web/nginx.conf

@@ -4,6 +4,10 @@ server {
 
     client_max_body_size 50M;
 
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
     root /usr/share/nginx/html;
     index index.html;
 

system1-factory/web/pages/admin/attendance-report.html

@@ -191,7 +191,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script type="module">
     import '/js/api-config.js?v=3';

system1-factory/web/pages/admin/departments.html

@@ -325,7 +325,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/department-management.js"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/admin/equipment-detail.html

@@ -315,7 +315,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script type="module">
     import '/js/api-config.js?v=3';

system1-factory/web/pages/admin/equipments.html

@@ -191,7 +191,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script type="module">
     import '/js/api-config.js?v=3';

system1-factory/web/pages/admin/issue-categories.html

@@ -330,7 +330,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script type="module" src="/js/issue-category-manage.js"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/admin/notifications.html

@@ -388,7 +388,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script>
         let currentPage = 1;
         let totalPages = 1;

system1-factory/web/pages/admin/projects.html

@@ -385,7 +385,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script>
     let allProjects = [];
     let filteredProjects = [];

system1-factory/web/pages/admin/repair-management.html

@@ -488,7 +488,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script>
         let currentReportId = null;
         let allRepairs = [];

system1-factory/web/pages/admin/tasks.html

@@ -286,7 +286,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script>
     let workTypes = [];
     let tasks = [];

system1-factory/web/pages/admin/workplaces.html

@@ -432,7 +432,7 @@
 
   <!-- 작업장 관리 모듈 (리팩토링된 구조) -->
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/workplace-management/state.js?v=1"></script>
   <script src="/js/workplace-management/utils.js?v=1"></script>
   <script src="/js/workplace-management/api.js?v=1"></script>

system1-factory/web/pages/attendance/annual-overview.html

@@ -329,7 +329,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script>
     // axios 설정

system1-factory/web/pages/attendance/checkin.html

@@ -223,7 +223,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script>
     (function() {

system1-factory/web/pages/attendance/daily.html

@@ -71,7 +71,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script>
     // axios 기본 설정

system1-factory/web/pages/attendance/monthly.html

@@ -475,7 +475,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script>
     // axios 기본 설정

system1-factory/web/pages/attendance/my-vacation-info.html

@@ -266,7 +266,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script>
     // axios 설정

system1-factory/web/pages/attendance/vacation-allocation.html

@@ -354,7 +354,7 @@
   </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script type="module" src="/js/vacation-allocation.js" defer></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/attendance/vacation-approval.html

@@ -124,7 +124,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script src="/js/vacation-common.js"></script>
   <script>

system1-factory/web/pages/attendance/vacation-input.html

@@ -124,7 +124,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script src="/js/vacation-common.js"></script>
   <script>

system1-factory/web/pages/attendance/vacation-management.html

@@ -206,7 +206,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script src="/js/vacation-common.js"></script>
   <script>

system1-factory/web/pages/attendance/vacation-request.html

@@ -118,7 +118,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script src="/js/vacation-common.js"></script>
   <script>

system1-factory/web/pages/attendance/work-status.html

@@ -277,7 +277,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
   <script>
     (function() {

system1-factory/web/pages/dashboard.html

@@ -324,7 +324,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script type="module" src="/js/modern-dashboard.js?v=10"></script>
     <script type="module" src="/js/group-leader-dashboard.js?v=1"></script>
     <script src="/js/workplace-status.js?v=3"></script>

system1-factory/web/pages/inspection/daily-patrol.html

@@ -210,7 +210,7 @@
     })();
   </script>
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/daily-patrol.js?v=6"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/inspection/zone-detail.html

@@ -305,7 +305,7 @@
     })();
   </script>
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/zone-detail.js?v=6"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/profile/info.html

@@ -321,7 +321,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script type="module" src="/js/my-profile.js"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/profile/password.html

@@ -391,7 +391,7 @@
     </div>
 
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script type="module" src="/js/change-password.js"></script>
   <script>initAuth();</script>
 </body>

system1-factory/web/pages/work/analysis.html

@@ -278,7 +278,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script type="module" src="/js/work-analysis.js?v=5"></script>
 
     <script>

system1-factory/web/pages/work/report-create-mobile.html

@@ -190,7 +190,7 @@
 
   <!-- 공통 모듈 -->
   <script src="/static/js/tkfb-core.js?v=20260313"></script>
-  <script src="/js/api-base.js?v=3"></script>
+  <script src="/js/api-base.js?v=20260313"></script>
   <script src="/js/common/utils.js?v=1"></script>
   <script src="/js/common/base-state.js?v=1"></script>
 

system1-factory/web/pages/work/report-create.html

@@ -150,7 +150,7 @@
     </div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script src="/js/common/utils.js?v=1"></script>
     <script src="/js/common/base-state.js?v=1"></script>
     <script src="/js/daily-work-report/state.js?v=2"></script>

system1-factory/web/pages/work/tbm-create.html

@@ -844,7 +844,7 @@
 
     <!-- Scripts -->
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <!-- 공통 모듈 -->
     <script src="/js/common/utils.js?v=2"></script>
     <script src="/js/common/base-state.js?v=2"></script>

system1-factory/web/pages/work/tbm-mobile.html

@@ -297,7 +297,7 @@
 
     <!-- 공통 모듈 -->
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script src="/js/common/utils.js?v=2"></script>
     <script src="/js/common/base-state.js?v=2"></script>
 

system1-factory/web/pages/work/tbm.html

@@ -561,7 +561,7 @@
     <div class="toast-container" id="toastContainer"></div>
 
     <script src="/static/js/tkfb-core.js?v=20260313"></script>
-    <script src="/js/api-base.js?v=3"></script>
+    <script src="/js/api-base.js?v=20260313"></script>
     <script src="/js/common/utils.js?v=2"></script>
     <script src="/js/common/base-state.js?v=2"></script>
     <script src="/js/tbm/state.js?v=3"></script>