deer-flow

mirror of https://github.com/bytedance/deer-flow.git synced 2026-08-14 08:49:00 +00:00

History

fix(security): neutralize prompt-injection tags in web_capture results (#4099 )

The remote-content allowlist in ToolResultSanitizationMiddleware
(`_REMOTE_CONTENT_TOOL_NAMES`) covered web_fetch / web_search /
image_search but not web_capture, which was added later. The Browserless
web_capture tool embeds the target site's `X-Response-Status` reason
phrase — free-form text controlled by whatever server is being captured
(RFC 7230 §3.1.2) — into its result message via `_target_status_warning`.
A malicious page could therefore forge a `<system-reminder>` block (or a
`--- END USER INPUT ---` boundary marker) through web_capture that would
be escaped for web_fetch, letting attacker-influenced remote content reach
the model as authoritative framework context.

Add "web_capture" to the allowlist so its result is structurally
neutralized for parity with the other remote-content tools. This extends
the same defense introduced in #4002 to the one built-in remote-content
tool it did not yet cover.

Add regression tests that build the web_capture result the way
community/browserless/tools.py does (real `_target_status_warning` +
`BrowserlessScreenshotResult`) and assert the forged tags/boundary markers
are escaped, while a benign status warning is preserved unchanged.

2026-07-12 11:24:24 +08:00

lead_agent

fix(front): resolve relative artifact image paths (#4038 )

2026-07-11 23:23:35 +08:00

memory

fix(security): html-escape memory facts rendered into the injection prompt (#4097 )

2026-07-12 11:03:46 +08:00

middlewares

fix(security): neutralize prompt-injection tags in web_capture results (#4099 )

2026-07-12 11:24:24 +08:00

__init__.py

feat: emit structured runtime metadata (follow-up#3887) (#3906 )