Zhipeng Zheng
|
e7b88a97ed
|
fix(security): add input sanitization middleware for prompt-injection defense (#3630) (#3662)
InputSanitizationMiddleware: escapes blocked XML tags in user messages (<system> -> <system>) — de-identify, don't reject (AWS PII-style). Wraps user input in plain-text boundary markers (--- BEGIN/END USER INPUT ---) per OWASP structured-prompt guidance. System-Context Confidentiality clause prevents LLM from revealing internal instructions. Boundary-marker layer hardened against delimiter injection (self-suppression + break-out). Multimodal content blocks preserved during sanitization.
Addresses review feedback from @fancyboi999 and @WillemJiang:
1. Boundary-marker injection: strict startswith+endswith idempotency, neutralize user-supplied BEGIN/END tokens, forged-idempotency bypass fixed
2. Multimodal data loss: _rebuild_content preserves interleaved non-text blocks
3. CI fixes: replay_provider strips boundary markers before hashing, middleware chain assertions updated
4. Lint: ruff format applied on Linux (slice spacing + f-string collapse)
Test: 71 input_sanitization + 1 replay_golden + 14 tool_error + 93 tool_output_budget = 179/179 passed
|
2026-06-21 19:01:43 +08:00 |
|