From 5b400aa04102ad64cf4b62cb14bc790824e73f7e Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 14:40:23 +0900
Subject: [PATCH 1/8] =?UTF-8?q?CLAP-372=20Chore:=20spring=20security=20XSS?=
 =?UTF-8?q?=20=EA=B3=B5=EA=B2=A9=20=EB=B0=A9=EC=A7=80=EB=A5=BC=20=EC=9C=84?=
 =?UTF-8?q?=ED=95=9C=20CSP=20=EC=84=A4=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../adapter/inbound/security/SecurityConfig.java    | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/main/java/clap/server/adapter/inbound/security/SecurityConfig.java b/src/main/java/clap/server/adapter/inbound/security/SecurityConfig.java
index 4538d189..6d2a3d49 100644
--- a/src/main/java/clap/server/adapter/inbound/security/SecurityConfig.java
+++ b/src/main/java/clap/server/adapter/inbound/security/SecurityConfig.java
@@ -63,6 +63,19 @@ public SecurityFilterChain defaultFilterChain(HttpSecurity http) throws Exceptio
 
     private HttpSecurity defaultSecurity(HttpSecurity http) throws Exception {
         return http
+                .headers(headers -> headers
+                        .contentSecurityPolicy(csp ->
+                                csp.policyDirectives(
+                                        "default-src 'self'; " +
+                                                "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
+                                                "style-src 'self' 'unsafe-inline'; " +
+                                                "img-src 'self' data: https:; " +
+                                                "font-src 'self' data: https:; " +
+                                                "object-src 'none'; " +
+                                                "base-uri 'self';"
+                                )
+                        )
+                )
                 .httpBasic(AbstractHttpConfigurer::disable)
                 .csrf(AbstractHttpConfigurer::disable)
                 .sessionManagement(

From baa9804aa7075e109f6079f4b97ed63d72ed970d Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 14:41:55 +0900
Subject: [PATCH 2/8] =?UTF-8?q?CLAP-372=20Feat:=20=EC=9A=94=EC=B2=AD=20?=
 =?UTF-8?q?=ED=95=84=EB=93=9C=EB=93=A4=20=EA=B0=92=EC=97=90=20=EB=8C=80?=
 =?UTF-8?q?=ED=95=9C=20xss=20=EA=B2=80=EC=82=AC=EB=A5=BC=20=ED=95=98?=
 =?UTF-8?q?=EB=8A=94=20=ED=95=84=ED=84=B0=20=EA=B5=AC=ED=98=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../inbound/xss/XssPreventionFilter.java      | 22 ++++++
 .../inbound/xss/XssRequestWrapper.java        | 72 +++++++++++++++++++
 2 files changed, 94 insertions(+)
 create mode 100644 src/main/java/clap/server/adapter/inbound/xss/XssPreventionFilter.java
 create mode 100644 src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java

diff --git a/src/main/java/clap/server/adapter/inbound/xss/XssPreventionFilter.java b/src/main/java/clap/server/adapter/inbound/xss/XssPreventionFilter.java
new file mode 100644
index 00000000..8b0167ac
--- /dev/null
+++ b/src/main/java/clap/server/adapter/inbound/xss/XssPreventionFilter.java
@@ -0,0 +1,22 @@
+package clap.server.adapter.inbound.xss;
+
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+
+@Component
+public class XssPreventionFilter implements Filter {
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        if (request instanceof HttpServletRequest) {
+            HttpServletRequest wrappedRequest = new XssRequestWrapper((HttpServletRequest) request);
+            chain.doFilter(wrappedRequest, response);
+        } else {
+            chain.doFilter(request, response);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java b/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java
new file mode 100644
index 00000000..0888cc70
--- /dev/null
+++ b/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java
@@ -0,0 +1,72 @@
+package clap.server.adapter.inbound.xss;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
+import lombok.extern.slf4j.Slf4j;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Safelist;
+
+import java.util.Arrays;
+import java.util.Enumeration;
+import java.util.Optional;
+
+@Slf4j
+public class XssRequestWrapper extends HttpServletRequestWrapper {
+
+    public XssRequestWrapper(HttpServletRequest request) {
+        super(request);
+    }
+
+    @Override
+    public String[] getParameterValues(String parameter) {
+        return Optional.ofNullable(super.getParameterValues(parameter))
+            .map(values -> Arrays.stream(values)
+                .map(this::sanitize)
+                .toArray(String[]::new))
+            .orElse(null);
+    }
+
+    @Override
+    public String getParameter(String parameter) {
+        String value = super.getParameter(parameter);
+        log.info("Original parameter [{}]: {}", parameter, value);
+
+        String sanitizedValue = Optional.ofNullable(value)
+                .map(this::sanitize)
+                .orElse(null);
+
+        log.info("Sanitized parameter [{}]: {}", parameter, sanitizedValue);
+        return sanitizedValue;
+    }
+
+    @Override
+    public String getHeader(String name) {
+        String originalValue = super.getHeader(name);
+        String sanitizedValue = sanitize(originalValue);
+        log.debug("Original header [{}]: {}", name, originalValue);
+        log.debug("Sanitized header [{}]: {}", name, sanitizedValue);
+        return sanitizedValue;
+    }
+
+    @Override
+    public Enumeration<String> getHeaderNames() {
+        return new Enumeration<String>() {
+            private Enumeration<String> enum1 = XssRequestWrapper.super.getHeaderNames();
+            @Override
+            public boolean hasMoreElements() {
+                return enum1.hasMoreElements();
+            }
+            @Override
+            public String nextElement() {
+                return sanitize(enum1.nextElement());
+            }
+        };
+    }
+
+
+    private String sanitize(String value) {
+        return Optional.ofNullable(value)
+            .map(str -> Jsoup.clean(str, Safelist.basic()))
+            .orElse(null);
+    }
+}
\ No newline at end of file

From 443da9515df558bd12ec973e65ca1b541f2f8b8d Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 14:44:32 +0900
Subject: [PATCH 3/8] =?UTF-8?q?CLAP-372=20Feat:=20XSS=20=EA=B3=B5=EA=B2=A9?=
 =?UTF-8?q?=20=EB=B0=A9=EC=A7=80=EB=A5=BC=20=EC=9C=84=ED=95=9C=20Configura?=
 =?UTF-8?q?tion=20=ED=81=B4=EB=9E=98=EC=8A=A4=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../server/config/jackson/JacksonConfig.java  | 37 +++++++++++++++++++
 .../clap/server/config/web/WebConfig.java     | 20 ++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 src/main/java/clap/server/config/jackson/JacksonConfig.java
 create mode 100644 src/main/java/clap/server/config/web/WebConfig.java

diff --git a/src/main/java/clap/server/config/jackson/JacksonConfig.java b/src/main/java/clap/server/config/jackson/JacksonConfig.java
new file mode 100644
index 00000000..47f5811a
--- /dev/null
+++ b/src/main/java/clap/server/config/jackson/JacksonConfig.java
@@ -0,0 +1,37 @@
+package clap.server.config.jackson;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import lombok.extern.slf4j.Slf4j;
+import org.jsoup.Jsoup;
+import org.jsoup.safety.Safelist;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import java.io.IOException;
+
+// XSS 방지를 위한 Jackson 설정
+@Slf4j
+@Configuration
+public class JacksonConfig {
+
+    @Bean
+    public ObjectMapper objectMapper() {
+        ObjectMapper mapper = new ObjectMapper();
+        SimpleModule module = new SimpleModule();
+        module.addDeserializer(String.class, new JsonHtmlXssDeserializer());
+        mapper.registerModule(module);
+        return mapper;
+    }
+
+    public static class JsonHtmlXssDeserializer extends JsonDeserializer<String> {
+        @Override
+        public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException {
+            String value = p.getText();
+            return Jsoup.clean(value, Safelist.basic());
+        }
+    }
+}
diff --git a/src/main/java/clap/server/config/web/WebConfig.java b/src/main/java/clap/server/config/web/WebConfig.java
new file mode 100644
index 00000000..764ee595
--- /dev/null
+++ b/src/main/java/clap/server/config/web/WebConfig.java
@@ -0,0 +1,20 @@
+package clap.server.config.web;
+
+import clap.server.adapter.inbound.xss.XssPreventionFilter;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+
+@Configuration
+public class WebConfig {
+
+    @Bean
+    public FilterRegistrationBean<XssPreventionFilter> xssPreventionFilterRegistrationBean() {
+        FilterRegistrationBean<XssPreventionFilter> registrationBean = new FilterRegistrationBean<>();
+        registrationBean.setFilter(new XssPreventionFilter());
+        registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE);
+        registrationBean.addUrlPatterns("/*");
+        return registrationBean;
+    }
+}
\ No newline at end of file

From 320dd9e38097d9c1a2188290bde74321bf4694fd Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 14:45:18 +0900
Subject: [PATCH 4/8] =?UTF-8?q?CLAP-372=20Chore:=20Jsoup=20=EB=9D=BC?=
 =?UTF-8?q?=EC=9D=B4=EB=B8=8C=EB=9F=AC=EB=A6=AC=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 build.gradle | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/build.gradle b/build.gradle
index 5d38b838..09654a25 100644
--- a/build.gradle
+++ b/build.gradle
@@ -107,6 +107,8 @@ dependencies {
     implementation 'org.apache.tika:tika-core:2.9.0'
     implementation 'org.apache.tika:tika-parsers:2.9.0'
 
+    // Jsoup
+    implementation 'org.jsoup:jsoup:1.17.1'
 }
 
 tasks.named('test') {

From bd740882bc0468d52b1980a3f3d66b19d33810a4 Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 15:03:48 +0900
Subject: [PATCH 5/8] =?UTF-8?q?CLAP-372=20Chore:=20xss=20=EA=B3=B5?=
 =?UTF-8?q?=EA=B2=A9=20=ED=85=8C=EC=8A=A4=ED=8A=B8=20api=20=EA=B5=AC?=
 =?UTF-8?q?=ED=98=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../inbound/web/XssTestController.java        | 31 +++++++++++++++++++
 .../adapter/inbound/web/XssTestRequest.java   |  8 +++++
 .../adapter/inbound/web/XssTestResponse.java  |  5 +++
 3 files changed, 44 insertions(+)
 create mode 100644 src/main/java/clap/server/adapter/inbound/web/XssTestController.java
 create mode 100644 src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java
 create mode 100644 src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java

diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestController.java b/src/main/java/clap/server/adapter/inbound/web/XssTestController.java
new file mode 100644
index 00000000..6c8fce1a
--- /dev/null
+++ b/src/main/java/clap/server/adapter/inbound/web/XssTestController.java
@@ -0,0 +1,31 @@
+package clap.server.adapter.inbound.web;
+
+import clap.server.common.annotation.architecture.WebAdapter;
+import clap.server.common.annotation.swagger.DevelopOnlyApi;
+import io.swagger.v3.oas.annotations.Operation;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+@Slf4j
+@WebAdapter
+@RequestMapping("/api/xss-test")
+public class XssTestController {
+
+    @GetMapping
+    @DevelopOnlyApi
+    @Operation(summary = "파라미터 xss test")
+    public ResponseEntity<String> testGetXss(@RequestParam String input) {
+        log.info("Received GET input: {}", input);
+        return ResponseEntity.ok("Processed GET input: " + input);
+    }
+
+    @PostMapping
+    @DevelopOnlyApi
+    @Operation(summary = "dto xss test")
+    public ResponseEntity<XssTestResponse> testPostXss(@RequestBody XssTestRequest request) {
+        log.info("Received POST input: {}", request);
+        return ResponseEntity.ok(new XssTestResponse(request.content()));
+    }
+}
diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java b/src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java
new file mode 100644
index 00000000..733a9de2
--- /dev/null
+++ b/src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java
@@ -0,0 +1,8 @@
+package clap.server.adapter.inbound.web;
+
+import jakarta.validation.constraints.NotNull;
+
+public record XssTestRequest(
+    @NotNull
+    String content
+) {}
\ No newline at end of file
diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java b/src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java
new file mode 100644
index 00000000..7c08d9c7
--- /dev/null
+++ b/src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java
@@ -0,0 +1,5 @@
+package clap.server.adapter.inbound.web;
+
+public record XssTestResponse(
+    String sanitizedContent
+) {}
\ No newline at end of file

From e18a626f261ccfb0659497c19d9a3f944bde36fb Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 15:26:35 +0900
Subject: [PATCH 6/8] =?UTF-8?q?CLAP-372=20Chore:=20=EB=8B=A4=EC=A4=91=20?=
 =?UTF-8?q?=ED=8C=8C=EB=9D=BC=EB=AF=B8=ED=84=B0=20xss=20=EA=B3=B5=EA=B2=A9?=
 =?UTF-8?q?=20=ED=85=8C=EC=8A=A4=ED=8A=B8=20api=20=EA=B5=AC=ED=98=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../adapter/inbound/web/XssTestController.java | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestController.java b/src/main/java/clap/server/adapter/inbound/web/XssTestController.java
index 6c8fce1a..f3d1ac5b 100644
--- a/src/main/java/clap/server/adapter/inbound/web/XssTestController.java
+++ b/src/main/java/clap/server/adapter/inbound/web/XssTestController.java
@@ -15,7 +15,7 @@ public class XssTestController {
 
     @GetMapping
     @DevelopOnlyApi
-    @Operation(summary = "파라미터 xss test")
+    @Operation(summary = "단일 파라미터 xss test")
     public ResponseEntity<String> testGetXss(@RequestParam String input) {
         log.info("Received GET input: {}", input);
         return ResponseEntity.ok("Processed GET input: " + input);
@@ -28,4 +28,20 @@ public ResponseEntity<XssTestResponse> testPostXss(@RequestBody XssTestRequest r
         log.info("Received POST input: {}", request);
         return ResponseEntity.ok(new XssTestResponse(request.content()));
     }
+
+    @GetMapping("/multi-params")
+    @Operation(summary = "다중 파라미터 XSS 테스트")
+    public ResponseEntity<String> testMultiParamXss(@RequestParam(value = "inputs", required = false) String[] inputs) {
+        if (inputs == null || inputs.length == 0) {
+            return ResponseEntity.badRequest().body("No inputs provided");
+        }
+
+        StringBuilder response = new StringBuilder("Processed inputs:\n");
+        for (int i = 0; i < inputs.length; i++) {
+            log.info("Received input {}: {}", i, inputs[i]);
+            response.append("Input ").append(i).append(": ").append(inputs[i]).append("\n");
+        }
+
+        return ResponseEntity.ok(response.toString());
+    }
 }

From 48aaec61fa90953d84940ab412bd1698cc40997a Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 15:27:45 +0900
Subject: [PATCH 7/8] =?UTF-8?q?CLAP-372=20Feat:=20javascript=20=EC=8A=A4?=
 =?UTF-8?q?=ED=82=A4=EB=A7=88=20=EA=B2=80=EC=A6=9D=20=EB=A1=9C=EC=A7=81=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../inbound/xss/XssRequestWrapper.java        | 40 ++++++-------------
 .../server/config/jackson/JacksonConfig.java  |  6 +++
 2 files changed, 18 insertions(+), 28 deletions(-)

diff --git a/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java b/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java
index 0888cc70..50cbc7af 100644
--- a/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java
+++ b/src/main/java/clap/server/adapter/inbound/xss/XssRequestWrapper.java
@@ -7,7 +7,6 @@
 import org.jsoup.safety.Safelist;
 
 import java.util.Arrays;
-import java.util.Enumeration;
 import java.util.Optional;
 
 @Slf4j
@@ -29,44 +28,29 @@ public String[] getParameterValues(String parameter) {
     @Override
     public String getParameter(String parameter) {
         String value = super.getParameter(parameter);
-        log.info("Original parameter [{}]: {}", parameter, value);
-
         String sanitizedValue = Optional.ofNullable(value)
                 .map(this::sanitize)
                 .orElse(null);
-
+        log.info("Original parameter [{}]: {}", parameter, value);
         log.info("Sanitized parameter [{}]: {}", parameter, sanitizedValue);
         return sanitizedValue;
     }
 
     @Override
     public String getHeader(String name) {
-        String originalValue = super.getHeader(name);
-        String sanitizedValue = sanitize(originalValue);
-        log.debug("Original header [{}]: {}", name, originalValue);
-        log.debug("Sanitized header [{}]: {}", name, sanitizedValue);
-        return sanitizedValue;
-    }
-
-    @Override
-    public Enumeration<String> getHeaderNames() {
-        return new Enumeration<String>() {
-            private Enumeration<String> enum1 = XssRequestWrapper.super.getHeaderNames();
-            @Override
-            public boolean hasMoreElements() {
-                return enum1.hasMoreElements();
-            }
-            @Override
-            public String nextElement() {
-                return sanitize(enum1.nextElement());
-            }
-        };
+        return Optional.ofNullable(super.getHeader(name))
+                .map(this::sanitize)
+                .orElse(null);
     }
 
 
-    private String sanitize(String value) {
-        return Optional.ofNullable(value)
-            .map(str -> Jsoup.clean(str, Safelist.basic()))
-            .orElse(null);
+    public String sanitize(String value) {
+        if (value == null) {
+            return null;
+        }
+        if (value.toLowerCase().startsWith("javascript:")) {
+            return "";
+        }
+        return Jsoup.clean(value, Safelist.basic());
     }
 }
\ No newline at end of file
diff --git a/src/main/java/clap/server/config/jackson/JacksonConfig.java b/src/main/java/clap/server/config/jackson/JacksonConfig.java
index 47f5811a..2711fab9 100644
--- a/src/main/java/clap/server/config/jackson/JacksonConfig.java
+++ b/src/main/java/clap/server/config/jackson/JacksonConfig.java
@@ -31,6 +31,12 @@ public static class JsonHtmlXssDeserializer extends JsonDeserializer<String> {
         @Override
         public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException {
             String value = p.getText();
+            if (value == null) {
+                return null;
+            }
+            if (value.toLowerCase().startsWith("javascript:")) {
+                return "";
+            }
             return Jsoup.clean(value, Safelist.basic());
         }
     }

From ac9a567df5294cc8c21c96c8ac630c97c330d570 Mon Sep 17 00:00:00 2001
From: joowojr <joowojr@gmail.com>
Date: Wed, 12 Feb 2025 15:37:31 +0900
Subject: [PATCH 8/8] =?UTF-8?q?CLAP-372=20Docs:=20=EC=8A=A4=EC=9B=A8?=
 =?UTF-8?q?=EA=B1=B0=20=EB=AA=85=EC=84=B8=20=EC=9E=91=EC=84=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<footer>
- 관련: #475
---
 .../web/{ => xss}/XssTestController.java        | 17 ++++++++++++-----
 .../inbound/web/{ => xss}/XssTestRequest.java   |  2 +-
 .../inbound/web/{ => xss}/XssTestResponse.java  |  2 +-
 3 files changed, 14 insertions(+), 7 deletions(-)
 rename src/main/java/clap/server/adapter/inbound/web/{ => xss}/XssTestController.java (64%)
 rename src/main/java/clap/server/adapter/inbound/web/{ => xss}/XssTestRequest.java (71%)
 rename src/main/java/clap/server/adapter/inbound/web/{ => xss}/XssTestResponse.java (58%)

diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestController.java b/src/main/java/clap/server/adapter/inbound/web/xss/XssTestController.java
similarity index 64%
rename from src/main/java/clap/server/adapter/inbound/web/XssTestController.java
rename to src/main/java/clap/server/adapter/inbound/web/xss/XssTestController.java
index f3d1ac5b..f1269e71 100644
--- a/src/main/java/clap/server/adapter/inbound/web/XssTestController.java
+++ b/src/main/java/clap/server/adapter/inbound/web/xss/XssTestController.java
@@ -1,9 +1,9 @@
-package clap.server.adapter.inbound.web;
+package clap.server.adapter.inbound.web.xss;
 
 import clap.server.common.annotation.architecture.WebAdapter;
 import clap.server.common.annotation.swagger.DevelopOnlyApi;
 import io.swagger.v3.oas.annotations.Operation;
-import jakarta.servlet.http.HttpServletRequest;
+import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
@@ -11,11 +11,18 @@
 @Slf4j
 @WebAdapter
 @RequestMapping("/api/xss-test")
+@Tag(name = "xss 공격 테스트 API", description = "아래와 같은 페이로드들에 대해 테스트합니다.\n" +
+        "1. 기본적인 스크립트 삽입: `<script>alert('xss')</script>`\n" +
+        "2. 이미지 태그를 이용한 XSS: `<img src=x onerror=alert('xss')>`\n" +
+        "3. JavaScript 프로토콜: `javascript:alert('xss')`\n" +
+        "4. HTML 이벤트 핸들러:` <div onmouseover=\"alert('xss')\">hover me</div>`\n" +
+        "5. SVG를 이용한 XSS: `<svg><script>alert('xss')</script></svg>`\n" +
+        "6. HTML5 태그를 이용한 XSS: `<video><source onerror=\"alert('xss')\">`")
 public class XssTestController {
 
     @GetMapping
     @DevelopOnlyApi
-    @Operation(summary = "단일 파라미터 xss test")
+    @Operation(summary = "단일 파라미터 test")
     public ResponseEntity<String> testGetXss(@RequestParam String input) {
         log.info("Received GET input: {}", input);
         return ResponseEntity.ok("Processed GET input: " + input);
@@ -23,14 +30,14 @@ public ResponseEntity<String> testGetXss(@RequestParam String input) {
 
     @PostMapping
     @DevelopOnlyApi
-    @Operation(summary = "dto xss test")
+    @Operation(summary = "dto test")
     public ResponseEntity<XssTestResponse> testPostXss(@RequestBody XssTestRequest request) {
         log.info("Received POST input: {}", request);
         return ResponseEntity.ok(new XssTestResponse(request.content()));
     }
 
     @GetMapping("/multi-params")
-    @Operation(summary = "다중 파라미터 XSS 테스트")
+    @Operation(summary = "다중 파라미터 테스트")
     public ResponseEntity<String> testMultiParamXss(@RequestParam(value = "inputs", required = false) String[] inputs) {
         if (inputs == null || inputs.length == 0) {
             return ResponseEntity.badRequest().body("No inputs provided");
diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java b/src/main/java/clap/server/adapter/inbound/web/xss/XssTestRequest.java
similarity index 71%
rename from src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java
rename to src/main/java/clap/server/adapter/inbound/web/xss/XssTestRequest.java
index 733a9de2..28179a27 100644
--- a/src/main/java/clap/server/adapter/inbound/web/XssTestRequest.java
+++ b/src/main/java/clap/server/adapter/inbound/web/xss/XssTestRequest.java
@@ -1,4 +1,4 @@
-package clap.server.adapter.inbound.web;
+package clap.server.adapter.inbound.web.xss;
 
 import jakarta.validation.constraints.NotNull;
 
diff --git a/src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java b/src/main/java/clap/server/adapter/inbound/web/xss/XssTestResponse.java
similarity index 58%
rename from src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java
rename to src/main/java/clap/server/adapter/inbound/web/xss/XssTestResponse.java
index 7c08d9c7..9a7c494c 100644
--- a/src/main/java/clap/server/adapter/inbound/web/XssTestResponse.java
+++ b/src/main/java/clap/server/adapter/inbound/web/xss/XssTestResponse.java
@@ -1,4 +1,4 @@
-package clap.server.adapter.inbound.web;
+package clap.server.adapter.inbound.web.xss;
 
 public record XssTestResponse(
     String sanitizedContent