v1.10.88 품질·보안 개선과 미디어 카탈로그 database 전환을 반영한다.

세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/utils/security-headers.js

@@ -0,0 +1,70 @@
+import { getRequestURL, setResponseHeader } from 'h3'
+
+const enforcedContentSecurityPolicy = [
+  "base-uri 'self'",
+  "object-src 'none'",
+  "frame-ancestors 'self'"
+].join('; ')
+
+const contentSecurityPolicyReportOnly = [
+  "default-src 'self' https: data: blob:",
+  "base-uri 'self'",
+  "object-src 'none'",
+  "frame-ancestors 'self'",
+  "script-src 'self' 'unsafe-inline' 'unsafe-eval' https:",
+  "style-src 'self' 'unsafe-inline' https:",
+  "img-src 'self' data: blob: https:",
+  "font-src 'self' data: https:",
+  "media-src 'self' blob: https:",
+  "frame-src https:",
+  "connect-src 'self' https: wss:",
+  "worker-src 'self' blob: https:",
+  "manifest-src 'self' https:",
+  'report-uri /api/csp-report',
+  'report-to csp-endpoint'
+].join('; ')
+
+/**
+ * 현재 요청과 같은 origin의 CSP 보고 URL을 안전하게 만든다.
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @returns {string} CSP 보고 URL
+ */
+const getCspReportEndpoint = (event) => {
+  try {
+    const requestUrl = getRequestURL(event)
+    if (!['http:', 'https:'].includes(requestUrl.protocol)) {
+      return '/api/csp-report'
+    }
+
+    const endpoint = new URL('/api/csp-report', requestUrl.origin).toString()
+    return /["\\\r\n]/.test(endpoint) ? '/api/csp-report' : endpoint
+  } catch {
+    return '/api/csp-report'
+  }
+}
+
+/**
+ * 공통 보안 헤더와 호환성 관찰 CSP를 적용한다.
+ * @param {import('h3').H3Event} event - 요청 이벤트
+ * @param {{ enforceCsp?: boolean }} options - 강제 CSP 적용 옵션
+ * @returns {void}
+ */
+export const applySecurityHeaders = (event, options = {}) => {
+  const reportEndpoint = getCspReportEndpoint(event)
+
+  setResponseHeader(event, 'X-Content-Type-Options', 'nosniff')
+  setResponseHeader(event, 'Referrer-Policy', 'strict-origin-when-cross-origin')
+  setResponseHeader(event, 'X-Frame-Options', 'SAMEORIGIN')
+  setResponseHeader(event, 'Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
+  setResponseHeader(event, 'Reporting-Endpoints', `csp-endpoint="${reportEndpoint}"`)
+  setResponseHeader(event, 'Report-To', JSON.stringify({
+    group: 'csp-endpoint',
+    max_age: 10886400,
+    endpoints: [{ url: reportEndpoint }]
+  }))
+  setResponseHeader(event, 'Content-Security-Policy-Report-Only', contentSecurityPolicyReportOnly)
+
+  if (options.enforceCsp !== false) {
+    setResponseHeader(event, 'Content-Security-Policy', enforcedContentSecurityPolicy)
+  }
+}