Aari
41b137c4c4
fix(security): block forged framework tags in the input guardrail ( #4155 ) ...
* fix(security): block forged framework tags in the input guardrail
InputSanitizationMiddleware's _BLOCKED_TAG_NAMES neutralizes forged
framework tags in untrusted input, but missed soul, thinking_style, and
critical_reminders -- which the lead-agent system prompt's System-Context
Confidentiality section names as internal framework data -- and the
underscore spelling system_reminder emitted by the todo/terminal
middlewares (only the hyphen spelling was blocked). A user, or an
attacker-controlled web_fetch/web_search page via the shared
neutralize_untrusted_tags primitive, could forge these blocks. Add them.
* fix(security): cover framework authority blocks as a class, not a subset
The confidentiality section declares every framework structured tag trusted
("and all other structured tags"), so the denylist must cover the authority
blocks as a class. Add the live blocks still passing both sanitization paths
(clarification_system, self_update, response_style, citations, skill_index,
available_skills, disabled_skills, memory_tool_system, durable_context_data,
slash_skill_activation), and pin the set against drift with a test that scans
the framework source and fails when a new block is not blocked.
* fix(security): scan the whole harness for framework blocks, fail closed
The drift guard added in the previous revision scanned a hand-listed set of
source files. That is the same forgot-to-update-a-list root cause the guard was
meant to eliminate, one level up, and it failed exactly that way: tool_search.py
was not in the list, so <mcp_routing_hints> and <available-deferred-tools> —
both rendered into the lead-agent system prompt via the {deferred_tools_section}
/ {mcp_routing_hints_section} placeholders — passed both sanitization paths
unneutralized.
Replace the file list with a repo-wide scan plus an exemption set that states a
reason per tag. The point is the failure direction, not the breadth: a new
framework block anywhere in the harness now turns CI red until it is either
blocked or exempted on the record, where before a block emitted from an unlisted
file was silently unguarded.
The scan reads raw source rather than AST string literals on purpose: an
attributed block built as an f-string splits its '>' into a separate literal
chunk, so an AST-on-literals scan misses it (verified against
<consolidation_candidates>). Raw source has one comment false positive, exempted.
Exempted with reasons: leaf/wrapper elements; the memory-updater and summarizer
prompts, which are built from checkpointed state rather than the ModelRequest
this middleware rewrites, so blocking them here would be false coverage, not
protection; and the MindIE provider wire format, parsed out of model output.
The scan surfaced five further live authority blocks beyond the two reported.
Subagents reuse _build_runtime_middlewares and therefore share this denylist, so
their system-prompt blocks are in the same class: file_editing_workflow,
guidelines, output_format, working_directory. goal_continuation is a
framework-authored hidden HumanMessage injected into the lead agent.
Also loosen the scanner regex to match the tolerance of _BLOCKED_TAG_PATTERN so
an attributed block cannot hide from the guard.
2026-07-14 11:04:11 +08:00
2026-07-14 10:43:13 +08:00
2026-07-01 22:49:17 +08:00
2026-07-04 21:31:01 +08:00
2026-05-12 23:18:54 +08:00
2026-06-30 18:58:02 +08:00
2026-04-26 15:09:25 +08:00
2026-06-01 15:50:39 +08:00
2026-07-05 08:45:27 +08:00
2026-06-21 20:56:42 +08:00
2026-06-08 12:35:03 +08:00
2026-03-27 20:03:30 +08:00
2026-06-18 10:15:31 +08:00
2026-06-11 17:53:37 +08:00
2026-07-14 07:51:59 +08:00
2026-05-21 14:44:34 +08:00
2026-07-03 21:52:31 +08:00
2026-06-23 10:39:40 +08:00
2026-06-21 22:16:00 +08:00
2026-07-11 23:05:03 +08:00
2026-05-29 23:05:59 +08:00
2026-05-16 09:24:40 +08:00
2026-04-26 11:08:11 +08:00
2026-06-16 23:20:20 +08:00
2026-07-02 08:28:29 +08:00
2026-06-21 15:47:53 +08:00
2026-06-24 13:57:12 +08:00
2026-07-09 17:21:25 +08:00
2026-07-09 17:21:25 +08:00
2026-07-02 11:00:49 +08:00
2026-07-05 09:54:55 +08:00
2026-07-14 07:37:59 +08:00
2026-06-16 23:04:39 +08:00
2026-06-18 10:15:31 +08:00
2026-07-12 08:54:03 +08:00
2026-05-02 15:19:28 +08:00
2026-07-12 23:40:52 +08:00
2026-06-18 10:45:33 +08:00
2026-07-13 16:14:36 +08:00
2026-04-14 10:29:44 +08:00
2026-07-12 08:15:32 +08:00
2026-07-12 08:15:32 +08:00
2026-07-06 22:34:41 +08:00
2026-03-30 07:41:18 +08:00
2026-04-25 19:40:06 +08:00
2026-04-07 18:21:22 +08:00
2026-07-04 13:54:04 +08:00
2026-07-03 08:01:46 +08:00
2026-03-29 21:03:58 +08:00
2026-05-04 09:56:16 +08:00
2026-07-13 19:26:07 +08:00
2026-05-02 15:04:11 +08:00
2026-06-10 21:36:25 +08:00
2026-03-14 22:55:52 +08:00
2026-07-05 09:40:16 +08:00
2026-07-07 19:55:33 +08:00
2026-04-26 11:05:47 +08:00
2026-07-05 09:54:55 +08:00
2026-03-29 15:31:18 +08:00
2026-07-04 11:27:19 +08:00
2026-05-07 16:15:15 +08:00
2026-06-12 15:24:58 +08:00
2026-07-13 21:13:33 +08:00
2026-07-09 16:40:10 +08:00
2026-06-08 07:59:50 +08:00
2026-07-13 17:57:34 +08:00
2026-06-02 22:43:22 +08:00
2026-06-05 15:21:41 +08:00
2026-07-12 00:17:11 +08:00
2026-07-04 23:09:29 +08:00
2026-06-02 22:43:22 +08:00
2026-07-01 22:49:17 +08:00
2026-07-13 19:26:07 +08:00
2026-07-04 09:21:19 +08:00
2026-05-26 23:30:24 +08:00
2026-07-04 21:31:01 +08:00
2026-07-04 09:21:19 +08:00
2026-06-12 17:16:01 +08:00
2026-06-09 15:29:40 +08:00
2026-06-18 10:15:31 +08:00
2026-06-12 15:24:58 +08:00
2026-06-13 23:27:17 +08:00
2026-03-31 22:19:27 +08:00
2026-07-02 11:00:49 +08:00
2026-07-13 19:26:07 +08:00
2026-07-01 22:49:17 +08:00
2026-07-04 22:56:24 +08:00
2026-04-26 11:09:56 +08:00
2026-04-08 17:13:39 +08:00
2026-07-05 09:54:55 +08:00
2026-07-02 11:33:32 +08:00
2026-07-14 10:43:13 +08:00
2026-07-10 11:01:39 +08:00
2026-07-02 08:24:15 +08:00
2026-07-04 21:31:01 +08:00
2026-04-10 17:43:39 +08:00
2026-05-21 21:18:10 +08:00
2026-05-11 17:38:37 +08:00
2026-07-04 11:27:19 +08:00
2026-07-03 08:49:33 +08:00
2026-06-07 11:24:30 +08:00
2026-07-11 16:05:30 +08:00
2026-07-06 08:00:49 +08:00
2026-07-14 10:43:13 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-12 15:51:22 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-04 22:56:24 +08:00
2026-07-03 08:49:33 +08:00
2026-07-12 23:33:52 +08:00
2026-06-21 15:55:10 +08:00
2026-07-11 18:40:07 +08:00
2026-03-14 22:55:52 +08:00
2026-07-06 07:21:12 +08:00
2026-07-14 10:43:13 +08:00
2026-07-06 22:34:41 +08:00
2026-07-10 11:08:30 +08:00
2026-03-26 14:20:18 +08:00
2026-06-28 16:10:44 +08:00
2026-07-08 17:10:27 +08:00
2026-07-14 11:04:11 +08:00
2026-07-04 13:54:04 +08:00
2026-06-17 15:29:22 +08:00
2026-05-19 22:11:46 +08:00
2026-06-08 23:25:29 +08:00
2026-07-12 11:51:31 +08:00
2026-06-10 16:11:00 +08:00
2026-07-13 19:26:07 +08:00
2026-07-13 19:26:07 +08:00
2026-07-04 23:09:29 +08:00
2026-07-11 07:54:15 +08:00
2026-04-11 16:52:10 +08:00
2026-07-09 17:21:25 +08:00
2026-07-03 07:51:22 +08:00
2026-07-13 00:01:22 +08:00
2026-07-04 13:54:04 +08:00
2026-07-13 00:01:22 +08:00
2026-07-04 13:54:04 +08:00
2026-07-03 08:01:46 +08:00
2026-04-30 22:27:14 +08:00
2026-05-07 16:15:15 +08:00
2026-07-12 23:12:20 +08:00
2026-07-03 15:39:12 +08:00
2026-07-09 16:26:31 +08:00
2026-04-25 09:18:13 +08:00
2026-07-04 13:54:04 +08:00
2026-07-12 11:59:36 +08:00
2026-07-10 07:54:36 +08:00
2026-07-09 16:26:31 +08:00
2026-07-09 16:26:31 +08:00
2026-07-14 09:49:43 +08:00
2026-07-04 09:40:05 +08:00
2026-06-25 22:57:00 +08:00
2026-07-14 09:49:43 +08:00
2026-07-11 08:54:45 +08:00
2026-07-12 18:22:22 +08:00
2026-05-15 10:26:35 +08:00
2026-07-12 20:41:41 +08:00
2026-06-18 11:45:35 +08:00
2026-07-12 23:00:45 +08:00
2026-07-14 07:40:49 +08:00
2026-04-26 15:09:25 +08:00
2026-04-17 12:00:31 +08:00
2026-04-26 11:09:55 +08:00
2026-07-11 15:28:16 +08:00
2026-04-26 15:09:25 +08:00
2026-07-14 07:40:49 +08:00
2026-07-06 22:34:41 +08:00
2026-07-11 16:05:30 +08:00
2026-07-04 13:54:04 +08:00
2026-05-15 22:30:05 +08:00
2026-03-22 20:39:26 +08:00
2026-07-14 09:32:53 +08:00
2026-07-14 08:58:06 +08:00
2026-07-11 16:05:30 +08:00
2026-07-14 07:37:59 +08:00
2026-06-22 18:55:20 +08:00
2026-06-21 15:47:53 +08:00
2026-05-28 08:20:52 +08:00
2026-07-11 16:05:30 +08:00
2026-07-04 21:44:22 +08:00
2026-05-28 18:24:32 +08:00
2026-06-08 22:04:38 +08:00
2026-03-26 15:07:05 +08:00
2026-06-09 18:01:43 +08:00
2026-06-12 15:24:58 +08:00
2026-06-24 13:57:12 +08:00
2026-07-11 16:05:30 +08:00
2026-06-24 13:57:12 +08:00
2026-07-11 16:05:30 +08:00
2026-06-24 13:57:12 +08:00
2026-06-24 13:57:12 +08:00
2026-07-11 16:05:30 +08:00
2026-06-24 13:57:12 +08:00
2026-06-24 10:57:45 +08:00
2026-05-21 16:22:09 +08:00
2026-04-26 11:13:01 +08:00
2026-04-10 20:40:30 +08:00
2026-07-09 23:25:38 +08:00
2026-07-14 07:51:59 +08:00
2026-07-06 20:57:41 +08:00
2026-07-11 23:20:53 +08:00
2026-06-17 21:11:44 +08:00
2026-03-14 22:55:52 +08:00
2026-03-14 22:55:52 +08:00
2026-07-03 08:01:46 +08:00
2026-07-14 07:51:59 +08:00
2026-06-08 17:32:41 +08:00
2026-06-09 21:58:31 +08:00
2026-07-11 15:58:07 +08:00
2026-07-11 15:58:07 +08:00
2026-06-24 17:47:04 +08:00
2026-07-02 07:43:09 +08:00
2026-04-26 15:09:25 +08:00
2026-07-12 13:03:02 +08:00
2026-07-02 07:43:09 +08:00
2026-07-14 10:43:13 +08:00
2026-07-14 07:37:59 +08:00
2026-05-21 14:48:28 +08:00
2026-07-14 07:37:59 +08:00
2026-07-13 19:26:07 +08:00
2026-06-01 15:50:39 +08:00
2026-06-24 10:24:36 +08:00
2026-07-03 07:46:04 +08:00
2026-05-03 23:40:59 +08:00
2026-05-22 21:20:28 +08:00
2026-05-22 21:20:28 +08:00
2026-05-22 21:20:28 +08:00
2026-06-25 22:43:28 +08:00
2026-06-03 22:02:27 +08:00
2026-07-03 07:51:22 +08:00
2026-04-09 17:21:23 +08:00
2026-06-23 23:13:12 +08:00
2026-07-13 18:34:41 +08:00
2026-06-25 08:06:17 +08:00
2026-07-12 11:32:41 +08:00
2026-07-12 23:42:58 +08:00
2026-07-04 13:54:04 +08:00
2026-06-12 10:20:38 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-07-04 21:51:57 +08:00
2026-06-12 09:45:26 +08:00
2026-05-17 08:59:42 +08:00
2026-06-19 11:23:07 +08:00
2026-03-26 14:20:18 +08:00
2026-06-18 07:36:35 +08:00
2026-06-27 23:30:54 +08:00
2026-07-07 23:09:06 +08:00
2026-06-21 16:08:25 +08:00
2026-05-12 23:18:54 +08:00
2026-06-14 10:40:16 +08:00
2026-07-05 19:55:39 +08:00
2026-06-19 21:57:03 +08:00
2026-07-04 23:09:29 +08:00
2026-07-04 11:27:19 +08:00
2026-07-04 11:27:19 +08:00
2026-07-04 23:09:29 +08:00
2026-07-07 21:44:28 +08:00
2026-07-13 10:40:22 +08:00
2026-05-28 15:48:32 +08:00
2026-07-10 14:05:47 +08:00
2026-07-11 15:58:07 +08:00
2026-07-11 15:58:07 +08:00
2026-07-04 13:54:04 +08:00
2026-03-25 16:28:33 +08:00
2026-07-11 15:58:07 +08:00
2026-07-07 21:44:28 +08:00
2026-07-07 21:44:28 +08:00
2026-05-03 23:40:59 +08:00
2026-07-04 23:09:29 +08:00
2026-07-04 13:54:04 +08:00
2026-05-07 08:34:43 +08:00
2026-07-14 09:55:38 +08:00
2026-06-18 10:09:46 +08:00
2026-07-08 21:58:33 +08:00
2026-07-13 18:38:32 +08:00
2026-07-13 19:33:40 +08:00
2026-03-30 16:02:23 +08:00
2026-06-12 15:24:58 +08:00
2026-07-12 23:04:59 +08:00
2026-07-11 22:46:10 +08:00
2026-06-14 10:30:45 +08:00
2026-06-08 23:17:22 +08:00
2026-07-14 08:14:21 +08:00
2026-07-13 10:40:22 +08:00
2026-07-13 19:26:07 +08:00
2026-04-23 23:59:47 +08:00
2026-05-02 06:37:49 +08:00
2026-07-11 15:41:57 +08:00
2026-07-11 15:41:57 +08:00
2026-07-13 19:26:07 +08:00
2026-06-19 21:42:42 +08:00
2026-07-08 17:10:27 +08:00
2026-07-10 11:17:35 +08:00
2026-07-07 19:55:33 +08:00
2026-07-01 22:30:55 +08:00
2026-06-24 07:28:17 +08:00
2026-07-11 15:41:57 +08:00
2026-05-21 21:18:10 +08:00
2026-06-18 10:15:31 +08:00
2026-07-11 15:53:14 +08:00
2026-07-10 22:13:50 +08:00
2026-06-21 21:43:43 +08:00
2026-07-14 10:43:13 +08:00
2026-06-12 15:24:58 +08:00
2026-06-20 18:59:42 +08:00
2026-07-04 09:21:19 +08:00
2026-06-02 22:43:22 +08:00
2026-07-03 08:49:33 +08:00
2026-05-22 21:42:14 +08:00
2026-07-06 07:40:41 +08:00
2026-07-08 14:41:16 +08:00
2026-06-10 23:26:15 +08:00
2026-03-14 22:55:52 +08:00
2026-07-11 23:15:03 +08:00
2026-06-12 22:48:47 +08:00
2026-07-08 22:26:06 +08:00
2026-07-04 23:14:46 +08:00
2026-05-10 22:00:57 +08:00
2026-06-23 23:37:41 +08:00
2026-03-26 14:20:18 +08:00
2026-05-10 23:09:03 +08:00
2026-05-19 22:11:46 +08:00
2026-07-11 08:29:42 +08:00
2026-07-04 11:27:19 +08:00
2026-07-10 08:07:25 +08:00
2026-04-06 15:09:57 +08:00
2026-07-06 20:57:41 +08:00
2026-07-06 20:57:41 +08:00
2026-07-12 11:24:24 +08:00
2026-07-14 09:49:43 +08:00
2026-07-03 08:01:46 +08:00
2026-07-03 08:01:46 +08:00
2026-07-14 08:58:06 +08:00
2026-07-14 08:58:06 +08:00
2026-07-03 08:01:46 +08:00
2026-07-03 08:49:33 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-07-03 08:49:33 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-06-25 20:10:49 +08:00
2026-07-12 12:13:02 +08:00
2026-05-12 23:18:54 +08:00
2026-07-04 22:56:24 +08:00
2026-07-01 16:43:56 +08:00
2026-07-14 10:43:13 +08:00
2026-07-04 21:31:01 +08:00
2026-04-26 15:09:25 +08:00
2026-07-04 13:54:04 +08:00
2026-07-11 09:18:12 +08:00
2026-07-14 10:43:13 +08:00
2026-05-02 15:16:16 +08:00
2026-06-09 15:29:40 +08:00
2026-06-08 22:04:38 +08:00
2026-04-28 11:13:17 +08:00
2026-04-06 15:18:34 +08:00
2026-07-04 09:21:19 +08:00
2026-07-06 07:21:12 +08:00
2026-07-04 21:35:05 +08:00
2026-07-12 07:52:45 +08:00
2026-07-05 00:07:27 +08:00
2026-07-12 11:51:31 +08:00
2026-07-06 22:24:14 +08:00
2026-06-07 17:47:11 +08:00
41b137c4c4