open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 5 Activity

fix(calibration): grade active content on URL shape, not construct type

Browse source 
v0.3.0 made the untrusted upload path unusable: measured on both doors, an
ordinary remote image fail_secure'd and an ordinary link/autolink/refdef
quarantined, so only documents without external references persisted.

Two independent defects compounded; neither fix works alone:

1. `markdown-image: HIGH` fired on any external image. The exfil primitive is a
   URL that moves bytes outward, not an image. `is_ordinary_url` now grades on
   shape - http(s)/protocol-relative, no query, no userinfo, no percent-escape,
   no opaque host label or path segment -> LOW; anything data-carrying keeps the
   carrier's severity. raw-html and data: URIs stay HIGH unconditionally.
   Opacity reuses entropy's primitives; floors calibrated against real doc URLs
   (worst legit token H=4.08, exfil segments 4.36-4.54) and frozen in
   calibration.

2. The quarantine_default floor fired on ANY finding, a premise that broke when
   every ordinary link became a finding. It now fires at MEDIUM+ - a no-op for
   every detector that shipped before 0.3.0 (no LOW/INFO exists), which is what
   makes this a patch rather than a minor.

The corpus blind spot that let this pass 522 green tests is closed: the FP
corpus carries realistic markdown and is asserted on the OUTPUT gate under
PRESET_USER_UPLOAD, with a counter-corpus of exfil-shaped URLs that must still
block. Beaconing and short opaque segments are conceded in LIMITATIONS and
asserted by the coverage matrix rather than papered over.

No new public API; no new preset (0.4.0 work); allow_reserved default unchanged.
This commit is contained in:
Kjell Tore Guttormsen 2026-07-25 15:36:02 +02:00
commit 6e9b8168e3
13 changed files with 533 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

26
src/llm_ingestion_guard/calibration.py
View file

@ -66,7 +66,9 @@ DISPOSITION_RANK = {
# --- active_content: per-construct severities -------------------------------
# Zero-click auto-fetch / auto-execute constructs are HIGH; click-required ones
# are MEDIUM. Mirrors ``neutralize``'s defang classes.
# are MEDIUM. Mirrors ``neutralize``'s defang classes. These are the severities
# of a construct whose URL can *carry data outward* — see the shape analysis
# below for the ordinary case.
ACTIVE_CONTENT_SEVERITY = {
"markdown-image": Severity.HIGH,
"markdown-link": Severity.MEDIUM,
@ -75,3 +77,25 @@ ACTIVE_CONTENT_SEVERITY = {
"raw-html": Severity.HIGH,
"data-uri": Severity.HIGH,
}
# --- active_content: URL shape analysis (0.3.1 recalibration) ---------------
# The exfiltration primitive is not "an image" — it is a URL that moves bytes to
# a host the attacker controls. Grading on construct type made
# ``![diagram](https://example.com/arch.png)`` HIGH, which fail-secured ordinary
# documents on the upload preset (measured, v0.3.0). A URL that only *names* a
# remote document is graded ORDINARY instead.
ACTIVE_CONTENT_ORDINARY_SEVERITY = Severity.LOW
# A URL token (host label or path segment) is *opaque* — carried data rather
# than a name — at these floors. Measured 2026-07-25 against real documentation
# URLs (Microsoft Learn, Wikipedia, GitHub raw, regjeringen.no): the worst
# legitimate token scored H=4.08 at length 44, while base64/hex payload segments
# scored 4.36-4.54; random base62 averages 4.23 at length 24. The floor sits
# above every measured legitimate token with margin, because a false positive
# here is what 0.3.1 exists to fix.
URL_OPAQUE_ENTROPY_H, URL_OPAQUE_MIN_LEN = 4.4, 24
# Hex floor for a URL token. Deliberately lower than ENTROPY_HEX_FLOOR_LEN (64):
# in prose a 32-char hex run is usually a checksum, but as a whole path segment
# or host label it is an opaque id — the md5/uuid length an exfil path uses.
URL_OPAQUE_HEX_MIN_LEN = 32