freemo
7b1020e735
CI / benchmark-publish (pull_request) Has been skipped
CI / lint (pull_request) Successful in 15s
CI / build (pull_request) Successful in 16s
CI / quality (pull_request) Successful in 18s
CI / typecheck (pull_request) Successful in 36s
CI / security (pull_request) Successful in 36s
CI / unit_tests (pull_request) Successful in 3m46s
CI / docker (pull_request) Successful in 39s
CI / integration_tests (pull_request) Successful in 4m30s
CI / coverage (pull_request) Successful in 4m35s
CI / lint (push) Successful in 12s
CI / build (push) Successful in 16s
CI / quality (push) Successful in 16s
CI / security (push) Successful in 33s
CI / typecheck (push) Successful in 35s
CI / benchmark-regression (push) Has been skipped
CI / unit_tests (push) Successful in 2m7s
CI / docker (push) Successful in 39s
CI / integration_tests (push) Successful in 3m4s
CI / coverage (push) Successful in 4m35s
CI / benchmark-publish (push) Has been cancelled
CI / benchmark-regression (pull_request) Successful in 29m37s
Implement spec-mandated prompt injection protections: 1. Input sanitization (PromptSanitizer.sanitize_user_input): escapes HTML entities, strips C0/C1 control characters, rejects 8 known injection patterns including instruction override, role assumption, ChatML tags, and boundary marker spoofing. 2. Prompt boundary markers (PromptSanitizer.wrap_user_content): wraps user content with [USER_CONTENT_START]/[USER_CONTENT_END] markers; augment_system_prompt() prepends boundary recognition instructions. 3. Output validation: existing schema_validator.py validates tool I/O against JSON Schema in ToolRuntime.execute() (verified, tested). 4. Tool capability restrictions: existing _enforce_capabilities() in lifecycle.py enforces read_only/writes/checkpointable/side_effects declarations (verified, tested). 5. Unsafe tool gating: existing _enforce_capabilities() blocks unsafe tools unless allow_unsafe_tools=true in automation profile (verified, tested). Integrates sanitizer into session prompt construction, invariant text processing, and action argument handling paths. ISSUES CLOSED: #572
84 lines
3.5 KiB
Plaintext
84 lines
3.5 KiB
Plaintext
*** Settings ***
|
|
Documentation Prompt Injection Mitigation — integration smoke tests
|
|
Library OperatingSystem
|
|
Library Process
|
|
Resource ${CURDIR}/common.resource
|
|
|
|
Suite Setup Setup Test Environment
|
|
Suite Teardown Cleanup Test Environment
|
|
|
|
*** Variables ***
|
|
${HELPER_SCRIPT} robot/helper_prompt_injection_mitigation.py
|
|
${SRC_DIR} ${CURDIR}/../src
|
|
|
|
*** Test Cases ***
|
|
Sanitizer Rejects Injection Pattern
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-injection-rejection
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Sanitizer Escapes HTML Entities
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-html-escape
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Sanitizer Strips Control Characters
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-control-chars
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Boundary Markers Wrap User Content
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-boundary-markers
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
System Prompt Augmentation
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-system-augment
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Sanitize And Wrap Convenience
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-sanitize-and-wrap
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Schema Validation Passes Valid Input
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-schema-valid
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Schema Validation Rejects Invalid Input
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-schema-invalid
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Capability Enforcement Blocks Write In ReadOnly
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-capability-readonly
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|
|
|
|
Unsafe Tool Gating
|
|
[Tags] security prompt-injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} test-unsafe-gating
|
|
... cwd=${WORKSPACE} env:PYTHONPATH=${SRC_DIR}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} PASS
|