 freemo
|
7b1020e735
|
feat(security): implement Prompt Injection Mitigation (5 mechanisms)
Implement spec-mandated prompt injection protections:
1. Input sanitization (PromptSanitizer.sanitize_user_input): escapes HTML
entities, strips C0/C1 control characters, rejects 8 known injection
patterns including instruction override, role assumption, ChatML tags,
and boundary marker spoofing.
2. Prompt boundary markers (PromptSanitizer.wrap_user_content): wraps user
content with [USER_CONTENT_START]/[USER_CONTENT_END] markers;
augment_system_prompt() prepends boundary recognition instructions.
3. Output validation: existing schema_validator.py validates tool I/O
against JSON Schema in ToolRuntime.execute() (verified, tested).
4. Tool capability restrictions: existing _enforce_capabilities() in
lifecycle.py enforces read_only/writes/checkpointable/side_effects
declarations (verified, tested).
5. Unsafe tool gating: existing _enforce_capabilities() blocks unsafe
tools unless allow_unsafe_tools=true in automation profile (verified,
tested).
Integrates sanitizer into session prompt construction, invariant text
processing, and action argument handling paths.
ISSUES CLOSED: #572
|
2026-03-08 22:19:40 +00:00 |
|