- 애플리케이션에 인증이 없어 같은 네트워크에서 오는 모든 요청을 신뢰한다고 가정하는 경우

## 공격 예시 { #example-attack }

로컬 AI 에이전트를 실행하는 방법을 만들었다고 가정해 봅시다.

이 에이전트는 다음 위치에 API를 제공합니다:

```
http://localhost:8000/v1/agents/multivac
```

또한 다음 위치에 프론트엔드가 있습니다:

```
http://localhost:8000
```

/// tip | 팁

두 주소 모두 같은 호스트를 사용합니다.

///

그런 다음 프론트엔드를 통해 AI 에이전트가 여러분을 대신해 작업을 수행하도록 할 수 있습니다.

            // Verify correct behavior for external parent:
            // - groupId should NOT be removed (external parents need groupId to be located)
            // - artifactId should NOT be removed (external parents need artifactId to be located)
            // - version should NOT be removed (external parents need version to be located)
            // This prevents the "parent.groupId is missing" error reported in issue #7934

          assert any such rights held by the Licensor to the limited
          extent necessary to allow You to exercise the Licensed
          Rights, but not otherwise.

       2. Patent and trademark rights are not licensed under this
          Public License.

       3. To the extent possible, the Licensor waives any right to
          collect royalties from You for the exercise of the Licensed

1. **Understand the content you submit, PRs as well as issues, and be able to explain it.** Our goal is for humans to use AI tools intentionally and with full control, rather than merely serving as proxies for AI agents. If you cannot explain the reason for something, we will assume you do not understand it, and the PR or issue will likely be closed.

                    this.hideCalendars();
                this.clickApply();
            }
        },

        clickPrev: function(e) {
            var cal = $(e.target).parents('.drp-calendar');
            if (cal.hasClass('left')) {
                this.leftCalendar.month.subtract(1, 'month');
                if (this.linkedCalendars)

- アプリケーションがローカル（例: `localhost`）または社内ネットワークで動作している
- かつ、アプリに認証がなく、同一ネットワークからのリクエストは信頼できると想定している

## 攻撃例 { #example-attack }

ローカルで AI エージェントを実行できる仕組みを構築したとします。

それは次の API を提供します。

```
http://localhost:8000/v1/agents/multivac
```

フロントエンドもあります。

```
http://localhost:8000
```

/// tip | 豆知識

両方とも同じホストであることに注意してください。

///

そのフロントエンドを使って、AI エージェントに自分の代わりに作業をさせられます。

- Tooling API client. This a library that is embedded into applications, such as IDEs or CI agents, that allows them to act as a Gradle client.
- Worker processes. Long-running daemon processes that the Gradle daemon starts to run specific kinds of work, such as compilation or test execution.

     * The returned list contains profiles from the current project and all of its ancestors in
     * the project inheritance chain.
     *
     * @return a non-null, possibly empty list of all profiles from this project and its parents
     * @see Profile
     * @see #getDeclaredProfiles()
     */
    @Nonnull
    List<Profile> getEffectiveProfiles();

    /**
     * Returns all active profiles for the current project build.

        def projectDir = 'C:\\tcagent1\\work\\f63322e10dd6b396\\'

        expect:

    /**
     * Gets the model resolver to use for resolution of mixins or parents that are not locally reachable from the
     * project directory.
     *
     * @return The model resolver or {@code null} if not set.
     */
    ModelResolver getModelResolver();

    /**
     * Sets the model resolver to use for resolution of mixins or parents that are not locally reachable from the
     * project directory.
     *