Yi Deng b36d7194d9
fix(security): neutralize prompt-injection tags in remote tool results (#4002)
* fix(security): neutralize prompt-injection tags in remote tool results

User input is already neutralized for framework/injection tags, but tool
results are not. Remote content fetched by web_fetch/web_search is equally
untrusted and can carry a forged <system-reminder> block that reaches the
model verbatim as authoritative context.

Extract a shared neutralize_untrusted_tags() primitive from
InputSanitizationMiddleware and apply it to remote-content tool results
(web_fetch/web_search/image_search) via a new ToolResultSanitizationMiddleware.
Local tool output (bash/read_file) is left untouched so legitimate code/file
content is never mangled.

* test: update subagent middleware count for tool-result sanitizer

The new ToolResultSanitizationMiddleware adds one entry to the shared runtime
chain (11 -> 12). Update the subagent count assertion, use a lazy import for
neutralize_untrusted_tags so the module loads even when tests stub the
input-sanitization module, and document the new middleware in AGENTS.md.

* fix(security): address review — sanitize bare str list items; document MCP scope

- Neutralize bare str elements inside a ToolMessage content list (previously
  only {type:text} dict blocks were rewritten), matching the str-in-list shape
  ToolOutputBudgetMiddleware._message_text already anticipates.
- Document the name-based allowlist limitation: MCP remote-content tools
  registered under arbitrary names (e.g. fetch_url) are not covered; a name
  heuristic is avoided to prevent mangling local tool output, with metadata
  tagging tracked as a follow-up. Add a regression test pinning this boundary.
2026-07-09 14:45:25 +08:00
..