fix: harden local command execution and SNI error handling

Use argument-based child process execution in the shadcn update script to avoid shell interpolation risks and add a nil-safe close fallback in SNI inspection error paths to prevent panics.

Made-with: Cursor

Author: fr4iser90

frontend/update-shadcn.cjs

@@ -2,7 +2,7 @@
 
 const fs = require("fs");
 const path = require("path");
-const { execSync } = require("child_process");
+const { execFileSync } = require("child_process");
 
 /**
  * shadcn 컴포넌트를 자동으로 업데이트하는 스크립트
@@ -69,12 +69,19 @@ function main() {
       try {
         console.log(`🔄 업데이트 중: ${componentName}...`);
 
-        const command = `npx shadcn@latest add -o -y ${componentName}`;
-        execSync(command, {
+        if (!/^[a-z0-9_-]+$/i.test(componentName)) {
+          throw new Error(`invalid component name: ${componentName}`);
+        }
+
+        execFileSync(
+          "npx",
+          ["shadcn@latest", "add", "-o", "-y", componentName],
+          {
           stdio: "pipe",
           encoding: "utf8",
           env: { ...process.env, npm_config_legacy_peer_deps: "true" },
-        });
+          }
+        );
 
         console.log(`✅ ${componentName} 업데이트 완료`);
         successCount++;

portal/server.go

@@ -396,7 +396,11 @@ func (s *Server) runSNIListener(ctx context.Context) error {
 func (s *Server) handleSNIConn(ctx context.Context, conn net.Conn) {
 	clientHello, wrappedConn, err := l4.InspectClientHello(conn, s.cfg.ClientHelloTimeout)
 	if err != nil {
-		_ = wrappedConn.Close()
+		if wrappedConn != nil {
+			_ = wrappedConn.Close()
+		} else {
+			_ = conn.Close()
+		}
 		return
 	}