open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 6 Activity
llm-ingestion-pipeline-secu.../tests
History
Kjell Tore Guttormsen 0eab4345bf
 feat(output): decode hex-wrapped credentials at the persist gate 
Gap 1 closed. The output gate finds runs of 32+ hex digits
(calibration.HEX_WRAP_MIN_LEN), decodes both byte alignments, keeps text
that is at least 80% printable (the base64 bar, now one shared helper in
entropy) and runs the credential patterns on it. A hex-wrapped AWS key
surfaces as decoded:egress:aws-access-key-id with "in hex run @ N" as
evidence; the value is never in it. Credentials only: a hex-wrapped
injection is not decoded.

Measured before and after on the same trees: all 3583 clean documents
(three FP populations and the 78 pinned OKF concepts) are identical line
for line under both presets (disposition, labels, severity, count,
offset); OKF import stays 47/31. They and 569 READMEs hold 2403 hex runs
of 32+ digits, none of which decodes to text. scan_output CPU 122.9 s
before, 123.4 s after; one solid hex run at the 1M cap 4.2 s -> 5.8 s.

14 new tests (10 red for the right reason first), 6 of 6 mutations red.
Matrix 146/146 + 5/5 gaps, suite 1274 passed, ReDoS sweep 169 patterns.
2026-11-01 17:06:44 +01:00
..
inbox_frontend.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
redos_clock.py test(redos): the dead row had the wrong payload, and the last wall clock is retired 2026-08-13 21:47:43 +02:00
test_active_content.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_attacks_2026.py feat(output): report an instruction in plain prose 2026-10-31 21:20:32 +01:00
test_calibration.py feat(output): decode hex-wrapped credentials at the persist gate 2026-11-01 17:06:44 +01:00
test_catalog_census.py test(threat-2026): freeze the catalog-number census at v1.4.1 2026-10-28 21:27:31 +01:00
test_catalog_numbers.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_catalog_register.py feat(watch): source list for the 16 catalogs and the 30-day release rule 2026-11-01 12:50:51 +01:00
test_contract.py fix(security): harden 5 adversarial-review findings (M1/M2/M3 + m4/m6) via TDD 2026-07-05 10:45:05 +02:00
test_corpus.py measure(fp): the upload door costs a human on 16-53% of benign documents 2026-08-10 21:32:56 +02:00
test_coverage_matrix.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_disposition.py docs(plan): kill the pointer that sent this session to the wrong section 2026-08-10 21:01:19 +02:00
test_docs_measurement_scripts.py feat(output): decode hex-wrapped credentials at the persist gate 2026-11-01 17:06:44 +01:00
test_entropy.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_fence.py feat(fence): randomized unspoofable delimiter + attacker marker-strip (TDD) [skip-docs] 2026-07-04 18:23:35 +02:00
test_gap_register.py feat(output): decode hex-wrapped credentials at the persist gate 2026-11-01 17:06:44 +01:00
test_grounding.py feat(grounding): SourceGroundingCheck protocol + pass-through default — the semantic-poisoning seam (TDD) [skip-docs] 2026-07-04 22:44:41 +02:00
test_hidden_markup.py feat(output): report hidden markup — tiny font, invisible colour, comments outside code 2026-10-31 17:01:39 +01:00
test_image_sequence.py feat(active): report a run of images whose order carries a value 2026-10-31 19:33:51 +01:00
test_input_cap.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_install_pins.py fix(llms): pin the install line to 1.8.0 and hold every pin to the version 2026-10-31 21:57:43 +01:00
test_invisible.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_lexicon.py feat(lexicon): count every match of a pattern, and give four gaps a measured reason 2026-11-01 14:57:11 +01:00
test_neutralize.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_okf.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_okf_inbox_uploads.py feat(inbox): .xlsx extraction — formula gate, hidden sheets, cell comments (stage 2h) 2026-07-07 07:41:00 +02:00
test_okf_showcase.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_output.py feat(output): decode hex-wrapped credentials at the persist gate 2026-11-01 17:06:44 +01:00
test_prose_instruction.py feat(output): report an instruction in plain prose 2026-10-31 21:20:32 +01:00
test_release_rule.py feat(watch): source list for the 16 catalogs and the 30-day release rule 2026-11-01 12:50:51 +01:00
test_report.py feat: scaffold package + report and sanitize modules (TDD) 2026-07-04 09:24:20 +02:00
test_sanitize.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_showcase.py fix(owasp): qualify every catalog number with the 2026 edition 2026-10-31 14:20:35 +01:00
test_url_shape_doc.py docs(url-shape): make the rule reconstructable, and record what three corpora measured 2026-07-27 08:56:24 +02:00
test_wiring.py feat(active-content): raw HTML graded on carrier, and a tag naming no target is inert 2026-08-12 00:42:44 +02:00