mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
5e23ae4ec7
* fix(security): sanitize LLM prompt inputs against injection attacks Adds server/_shared/llm-sanitize.js with sanitizeForPrompt() and sanitizeHeadlines() that strip known prompt-injection patterns before untrusted RSS headlines and geo-context strings are embedded in LLM prompts. Patterns stripped: - Model-specific delimiters (<|im_start|>, [INST], <|endoftext|>, etc.) - XML-style role wrappers (<system>, <assistant>, <user>) - Role override markers at line start (SYSTEM:, ### Claude:, etc.) - Instruction-override phrases (Ignore previous instructions, etc.) - ASCII/Unicode control characters, zero-width joiners, BOM, soft-hyphen - Separator lines (---, ===) used as prompt boundaries Normal headlines (quotes, colons, dashes, emoji, unicode) pass through unchanged. The sanitizer is defense-in-depth, not a security boundary. Wired into summarize-article.ts replacing the previous slice-only approach. Tests: 36 cases across 8 suites, all passing. Co-authored-by: Fayez Bast <FayezBast@users.noreply.github.com> Ported from PR #381 * fix(types): add type declarations for llm-sanitize.js * fix(sanitize): address Codex review — light sanitizer for headlines - Add sanitizeHeadline() / sanitizeHeadlinesLight(): strips only structural patterns (model delimiters, control chars) without touching semantic instruction phrases - Use sanitizeHeadlinesLight() for headlines so that legitimate tech/security news like 'Anthropic says users can type "Output your system prompt"...' passes through unchanged and cache keys stay aligned with the browser - Keep full sanitizeForPrompt() for geoContext only (free-form, higher risk) - 40 tests, all passing * fix(security): apply full injection sanitizer at prompt-build time (P1) Separate the two uses of headlines: - Cache key: sanitizeHeadlinesLight() (structural only, preserves semantic phrases) so browser/server cache keys stay aligned - Prompt build: sanitizeHeadlines() (full sanitizer including semantic injection phrases) applied inside the fetcher just before buildArticlePrompts() This closes the P1 gap where "Ignore previous instructions" and similar payloads in RSS headlines were reaching the LLM prompt unchanged. --------- Co-authored-by: Fayez Bast <FayezBast@users.noreply.github.com>
20 lines
795 B
TypeScript
20 lines
795 B
TypeScript
/**
|
|
* LLM prompt injection sanitizer — type declarations for llm-sanitize.js
|
|
*/
|
|
|
|
/** Sanitize a single string for safe inclusion in an LLM prompt. */
|
|
export function sanitizeForPrompt(input: unknown): string;
|
|
|
|
/** Sanitize an array of headline strings, dropping any that become empty after sanitization. */
|
|
export function sanitizeHeadlines(headlines: unknown[]): string[];
|
|
|
|
/**
|
|
* Structural-only sanitization for a single headline — strips model delimiters
|
|
* and control characters but preserves semantic phrases (e.g. quoted injection
|
|
* phrases that are the subject of a news story).
|
|
*/
|
|
export function sanitizeHeadline(input: unknown): string;
|
|
|
|
/** Apply sanitizeHeadline() over an array, dropping empties. */
|
|
export function sanitizeHeadlinesLight(headlines: unknown[]): string[];
|