Kjell Tore Guttormsen
6e9b8168e3
v0.3.0 made the untrusted upload path unusable: measured on both doors, an ordinary remote image fail_secure'd and an ordinary link/autolink/refdef quarantined, so only documents without external references persisted. Two independent defects compounded; neither fix works alone: 1. `markdown-image: HIGH` fired on any external image. The exfil primitive is a URL that moves bytes outward, not an image. `is_ordinary_url` now grades on shape - http(s)/protocol-relative, no query, no userinfo, no percent-escape, no opaque host label or path segment -> LOW; anything data-carrying keeps the carrier's severity. raw-html and data: URIs stay HIGH unconditionally. Opacity reuses entropy's primitives; floors calibrated against real doc URLs (worst legit token H=4.08, exfil segments 4.36-4.54) and frozen in calibration. 2. The quarantine_default floor fired on ANY finding, a premise that broke when every ordinary link became a finding. It now fires at MEDIUM+ - a no-op for every detector that shipped before 0.3.0 (no LOW/INFO exists), which is what makes this a patch rather than a minor. The corpus blind spot that let this pass 522 green tests is closed: the FP corpus carries realistic markdown and is asserted on the OUTPUT gate under PRESET_USER_UPLOAD, with a counter-corpus of exfil-shaped URLs that must still block. Beaconing and short opaque segments are conceded in LIMITATIONS and asserted by the coverage matrix rather than papered over. No new public API; no new preset (0.4.0 work); allow_reserved default unchanged.
38 lines
1.5 KiB
TOML
38 lines
1.5 KiB
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "llm-ingestion-guard"
|
|
version = "0.3.1"
|
|
description = "A minimal, dependency-light defensive layer for LLM ingestion pipelines — the write-time siblings of query-time chatbot guardrails."
|
|
readme = "README.md"
|
|
requires-python = ">=3.10"
|
|
license = { file = "LICENSE" }
|
|
authors = [{ name = "Kjell Tore Guttormsen" }]
|
|
keywords = ["llm", "security", "prompt-injection", "rag", "ingestion", "guardrails", "write-time"]
|
|
classifiers = [
|
|
"Development Status :: 3 - Alpha",
|
|
"Intended Audience :: Developers",
|
|
"License :: OSI Approved :: MIT License",
|
|
"Programming Language :: Python :: 3",
|
|
"Topic :: Security",
|
|
]
|
|
dependencies = [] # stdlib-only core — see design principle 1
|
|
|
|
[project.optional-dependencies]
|
|
ml = [] # pluggable embedding/classifier detectors (placeholder)
|
|
judge = [] # LLM-judge / source-grounding implementation (placeholder)
|
|
# Showcase-only extraction parsers for the two-stage OKF inbox demo (docs/PLAN.md
|
|
# §247). Deliberately in `dev`, NOT the core `dependencies` (which stays []) and
|
|
# NOT a public `[extract]` extra — the front-end is an in-repo demonstration, not
|
|
# v1 shipped code. They pull lxml/Pillow transitively; that footprint is dev-only.
|
|
dev = ["pytest>=8", "python-docx>=1.2", "python-pptx>=1.0", "openpyxl>=3.1"]
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/llm_ingestion_guard"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
pythonpath = ["src"]
|
|
addopts = "-q"
|