Kjell Tore Guttormsen 4d53765c63 feat(guard): active-content detector wired into the output gate (review MAJOR #1 )

Close the EchoLeak wiring hole (CVE-2025-32711 class): markdown images/
links, reference definitions, autolinks, raw active HTML and data: URIs
now surface as report-only findings (active:*, OWASP LLM05) in
scan_output step 6, so screen_output and okf.import_bundle dispose of
them instead of admitting them with findings=[].

- new active_content.py: canonical home of the shared pattern table +
  scan_active_content; neutralize refactored to import it (mutating API
  and behavior unchanged, all neutralize tests pass as-is)
- images/links flagged only for absolute/protocol-relative URLs:
  relative in-bundle links are legitimate wiki/OKF mechanism (principle 5)
- evidence carries defanged URLs only (hxxps://evil[.]example)
- EchoLeak vectors planted in both showcases; detach proofs cover them
- README export list + checklist step 6, CLAUDE.md context line updated

Suite: 321 -> 341 passed. Core invariant intact (dependencies=[]).

2026-07-15 06:11:33 +02:00

1.8 KiB

Raw Blame History

llm-ingestion-pipeline-security

Kontekst

Gjenbrukbar, minimal defensiv layer for LLM ingestion-pipelines (write-time), til forskjell fra query-time chatbot-guardrails. Pakker det arkitektoniske kontraktet — sanitize → fence → tool-less karantenert transform → per-stadium capability-isolasjon → scan output før commit → fail-secure — som komponerbar, framework-agnostisk kode.

Referanse-implementasjon: claude-code-llm-wiki Stage B (tools/wiki_ingest/). Lexikon-seed: injection-patterns.mjs fra llm-security-pluginen.

Repoet er på v0.2 (alpha): stdlib-kjernen er bygget og testet (12 moduler + topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold- detektor (EchoLeak-klassen) i output-gaten. Start med docs/BRIEF.md for design, README.md for bruk, docs/PLAN.md for byggerekkefølgen.

Konvensjoner

Norsk for dialog og planer, engelsk for kode og innhold (repoet er publisert).
Ingen GitHub — kun Forgejo (git.fromaitochitta.com).
Remote satt: offentlig open/-speil på Forgejo; push hver commit (durabelt autorisert).
Minimal-dependency: stdlib-first kjerne; ML/judge-detektorer bak extras.

Communication patterns

Linking to local files

When pointing to local files in responses, always use markdown link syntax with a descriptive name:

Use [Human-friendly name](file:///absolute/path) — never bare file:///... URLs or autolinks <file://...>.
Always use absolute paths. Never ~/ or relative paths.
For multiple files, render as a bullet list of named markdown links.

Why: bare file:// URLs only render the first as clickable across multiple lines. Named markdown links make each entry independently clickable and look cleaner.

Example:

Brief