feat(llm-security): swap injection tables to vendored commons lexicon
Third consumer swap of v8 Phase 5 step 4, after codepoints and OWASP_MAP, and the last one with a behavioural gate behind it. The 83 regex literals leave injection-patterns.mjs; the four arrays are now built in scanners/lib/injection-lexicon.mjs from the vendored lexicon/injection-lexicon.json and re-exported unchanged, so every consumer sees the same published surface. Behaviour-preserving by measurement, not by intent. The proven recipe ran in order: a differential over all 83 positions (regex source, flags, label, aliases.llm_security) found 0 divergences BEFORE anything changed; the golden dump was then diffed post-for-post rather than read as a 9000- character assertion, and the ONLY changed record was the sha256 of injection-patterns.mjs itself -- 83 regex posts, 7 table records and all counts identical. That single file digest is the diff a swap MUST produce, so the baseline was re-blessed rather than silenced. Two deliberate departures from the two earlier swaps: FAILURE IS LOUD. codepoints and owasp-map fail silently on purpose: an empty codepoint table weakens normalization, an empty OWASP map mislabels a report. An empty injection table is different in kind -- scanForInjection returns found:false for every input, and the UserPromptSubmit scan, the MCP output scan and the pre-compact scan all go blind while reporting success. That is precisely the v7.8.2 defect class, which bit this plugin four times in one release. An unresolvable commons therefore writes one line to stderr naming the disabled capability. It still does not throw: hooks run per-tool-call, and a module-load throw breaks the tool call instead of degrading the scan. The warning is suppressed for an explicit commonsRoot, so tests and dev checkouts stay quiet and the line keeps meaning something. ENTRIES COMPILE DEFENSIVELY. commons is vendored data, not code. An uncompilable pattern or unknown flag would throw inside new RegExp at module load -- in a hook. Malformed entries are dropped instead, the same call owasp-map.mjs makes for a non-array value. Gates proven by mutating the vendored JSON in BOTH directions, five ways, all firing: re-adding the script-tag tail commons dropped (golden 1, lexicon 2, corpus 1), dropping a critical pattern (2/1/3), stripping the `m` flag off a spoofed-header anchor (2/1), adding a pattern commons never published (2/2/85), and removing commons outright -- which produced the stderr line, four empty tables and 5 red rather than a green suite over zero patterns. Lexicon restored byte-identical after each. Full suite 2191 pass / 0 fail / 6 skipped (2184 -> 2197). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017XDdiKC9ZXmcSUQ2m84s6y
This commit is contained in:
parent
21a52ac49d
commit
be148671ee
5 changed files with 386 additions and 165 deletions
|
|
@ -2,176 +2,41 @@
|
|||
// Used by pre-prompt-inject-scan.mjs (UserPromptSubmit) and post-mcp-verify.mjs (PostToolUse).
|
||||
//
|
||||
// Patterns derived from skill-scanner-agent Category 1 (LLM01 Prompt Injection)
|
||||
// and Category 5 (Hidden Instructions) in knowledge/skill-threat-patterns.md.
|
||||
// and Category 5 (Hidden Instructions) in knowledge/skill-threat-patterns.md,
|
||||
// and published since v8 through vendored commons — see the table section below.
|
||||
//
|
||||
// Zero external dependencies beyond ./string-utils.mjs.
|
||||
// Zero external dependencies beyond ./string-utils.mjs and ./injection-lexicon.mjs.
|
||||
|
||||
import { normalizeForScan, containsUnicodeTags, decodeUnicodeTags, foldHomoglyphs, rot13 } from './string-utils.mjs';
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Critical patterns — direct injection attempts (should be blocked)
|
||||
// Pattern tables — built from vendored commons, re-exported here
|
||||
// ---------------------------------------------------------------------------
|
||||
//
|
||||
// v8 Phase 5 step 4, third consumer swap. These four arrays were 83 regex
|
||||
// literals in this file; they now come from `lexicon/injection-lexicon.json`
|
||||
// in the vendored llm-security-commons subtree, via injection-lexicon.mjs.
|
||||
// Measured before the swap over all 83 positions — regex source, flags, label
|
||||
// and `aliases.llm_security` — against commons v0.3.0: zero divergences, in
|
||||
// order. The tables are re-exported rather than wrapped so that the published
|
||||
// surface is unchanged for every consumer (content-extractor.mjs spreads them,
|
||||
// the golden gate walks them as `injection-patterns`, hooks import this file).
|
||||
//
|
||||
// Where the data now lives, and why the loud half is not here: see the header
|
||||
// of injection-lexicon.mjs. In short — an unresolvable commons yields empty
|
||||
// tables and one line on stderr, because an injection gate that silently stops
|
||||
// detecting is the failure mode this plugin most needs to not have.
|
||||
|
||||
export const CRITICAL_PATTERNS = [
|
||||
// Direct override instructions
|
||||
{ pattern: /ignore\s+(?:all\s+)?previous/i, label: 'override: ignore previous instructions' },
|
||||
{ pattern: /forget\s+your\s+(?:instructions|rules|guidelines|directives)/i, label: 'override: forget instructions' },
|
||||
{ pattern: /disregard\s+your/i, label: 'override: disregard instructions' },
|
||||
{ pattern: /override\s+your/i, label: 'override: override instructions' },
|
||||
{ pattern: /suspend\s+all\s+constraints/i, label: 'override: suspend constraints' },
|
||||
{ pattern: /all\s+prior\s+constraints/i, label: 'override: prior constraints' },
|
||||
// Imported AND re-exported, not `export ... from`: the two functions below
|
||||
// read these tables directly, and a bare re-export would not bind them here.
|
||||
import {
|
||||
CRITICAL_PATTERNS,
|
||||
HIGH_PATTERNS,
|
||||
MEDIUM_PATTERNS,
|
||||
HYBRID_PATTERNS,
|
||||
} from './injection-lexicon.mjs';
|
||||
|
||||
// Spoofed system headers
|
||||
{ pattern: /^#+\s*SYSTEM\s*:/m, label: 'spoofed header: # SYSTEM:' },
|
||||
{ pattern: /^\[INST\]/m, label: 'spoofed header: [INST]' },
|
||||
{ pattern: /<\|system\|>/, label: 'spoofed header: <|system|>' },
|
||||
{ pattern: /<system>/, label: 'spoofed tag: <system>' },
|
||||
{ pattern: /<\/system>/, label: 'spoofed tag: </system>' },
|
||||
{ pattern: /^###\s*Instructions\s*:/m, label: 'spoofed header: ### Instructions:' },
|
||||
|
||||
// Identity redefinition
|
||||
{ pattern: /you\s+are\s+no\s+longer/i, label: 'identity: you are no longer' },
|
||||
{ pattern: /you\s+are\s+now\s+(?!able|going|ready|done|running|using|looking|in\s|at\s|on\s)/i, label: 'identity: you are now [name]' },
|
||||
{ pattern: /your\s+new\s+role\s+is/i, label: 'identity: your new role' },
|
||||
{ pattern: /your\s+new\s+primary\s+directive/i, label: 'identity: new primary directive' },
|
||||
{ pattern: /pretend\s+you\s+are/i, label: 'identity: pretend you are' },
|
||||
|
||||
// Configuration manipulation
|
||||
{ pattern: /ignore\s+your\s+CLAUDE\.md/i, label: 'config: ignore CLAUDE.md' },
|
||||
{ pattern: /override\s+your\s+system\s+prompt/i, label: 'config: override system prompt' },
|
||||
{ pattern: /bypass\s+your\s+safety/i, label: 'config: bypass safety' },
|
||||
{ pattern: /disable\s+output\s+filtering/i, label: 'config: disable output filtering' },
|
||||
];
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Medium patterns — obfuscation and indirect manipulation (advisory)
|
||||
// Lower confidence than High; flag for manual review.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export const MEDIUM_PATTERNS = [
|
||||
// Leetspeak variants of critical keywords
|
||||
{ pattern: /[1!|l][gq9]n[o0]r[e3]\s+(?:all\s+)?pr[e3]v[i1!|l][o0]us/i, label: 'leetspeak: ignore previous (obfuscated)' },
|
||||
{ pattern: /f[o0]rg[e3]t\s+y[o0]ur\s+[i1!|l]nstruct[i1!|l][o0]ns/i, label: 'leetspeak: forget instructions (obfuscated)' },
|
||||
{ pattern: /d[i1!|l]sr[e3]g[a4@]rd\s+y[o0]ur/i, label: 'leetspeak: disregard your (obfuscated)' },
|
||||
{ pattern: /[o0]v[e3]rr[i1!|l]d[e3]\s+y[o0]ur/i, label: 'leetspeak: override your (obfuscated)' },
|
||||
|
||||
// Homoglyph detection — Cyrillic chars in Latin context
|
||||
{ pattern: /[a-zA-Z][\u0430\u0435\u043E\u0440\u0441\u0456\u0443]|[\u0430\u0435\u043E\u0440\u0441\u0456\u0443][a-zA-Z]/, label: 'homoglyph: Cyrillic-Latin mixing in adjacent characters' },
|
||||
|
||||
// Zero-width characters inside words (keyword splitting evasion)
|
||||
{ pattern: /\w[\u200B\u200C\u200D\uFEFF]\w/, label: 'unicode: zero-width character inside word (keyword splitting)' },
|
||||
|
||||
// Indirect AI-directed instructions
|
||||
{ pattern: /(?:note|message|instruction)\s+(?:to|for)\s+(?:the\s+)?(?:AI|assistant|model|LLM|Claude)\b/i, label: 'indirect: instruction addressed to AI/assistant' },
|
||||
{ pattern: /(?:dear|attention)\s+(?:AI|assistant|model|LLM|Claude)\b/i, label: 'indirect: direct address to AI/assistant' },
|
||||
{ pattern: /when\s+(?:you|the\s+AI|the\s+assistant|Claude)\s+(?:read|see|encounter|process)\s+this/i, label: 'indirect: trigger-based instruction for AI' },
|
||||
|
||||
// Multi-language injection variants
|
||||
{ pattern: /ignor(?:ez?|er?)\s+(?:les?\s+)?instructions?\s+pr[e\u00e9]c[e\u00e9]dentes?/i, label: 'multi-lang: French "ignore previous instructions"' },
|
||||
{ pattern: /ignor(?:ar?|e)\s+(?:las?\s+)?instrucciones?\s+anteriores?/i, label: 'multi-lang: Spanish "ignore previous instructions"' },
|
||||
{ pattern: /ignorier(?:e|en)?\s+(?:alle\s+)?vorherigen?\s+(?:Anweisungen|Instruktionen)/i, label: 'multi-lang: German "ignore previous instructions"' },
|
||||
|
||||
// Markdown link-reference comment injection
|
||||
{ pattern: /\[\/\/\]:\s*#\s*\(.*(?:ignore|override|system|instruction|execute)/i, label: 'markdown: suspicious instruction in link-reference comment' },
|
||||
|
||||
// Data URI with executable content types
|
||||
{ pattern: /data:(?:text\/html|application\/javascript|text\/javascript)[;,]/i, label: 'data-uri: executable content type' },
|
||||
|
||||
// --- Content Injection: Syntactic Masking (AI Agent Traps) ---
|
||||
{ pattern: /\[[^\]]*(?:system|ignore|override|exfiltrate|execute)[^\]]*\]\([^)]+\)/i, label: 'markdown: injection payload in link anchor text' },
|
||||
|
||||
// --- Sub-agent spawning traps (DeepMind kat. 4, v5.0 S4) ---
|
||||
{ pattern: /(?:create|spawn|launch|start|run)\s+(?:an?\s+)?(?:new\s+)?(?:sub-?agent|agent|task|worker)\s+(?:that|to|which|with)\s+(?:.*?\s+)?(?:execute|run|delete|remove|send|post|exfiltrate|access|reads?\s+(?:.*?\s+)?(?:secret|credential|key|token|\.env|\.ssh))/i, label: 'sub-agent: spawn instruction with dangerous capability keywords' },
|
||||
{ pattern: /(?:delegate|dispatch)\s+(?:to\s+)?(?:an?\s+)?(?:new\s+)?(?:agent|sub-?agent|task)\s+.*?(?:bypass|override|ignore|without\s+(?:review|confirmation|approval))/i, label: 'sub-agent: delegation with safety bypass instruction' },
|
||||
|
||||
// --- Natural Language Indirection (Preamble, CaMeL — v5.0 S4) ---
|
||||
{ pattern: /fetch\s+(?:this|the|that)\s+(?:URL|link|endpoint)\s+and\s+(?:execute|run|eval)/i, label: 'nl-indirection: fetch URL and execute' },
|
||||
{ pattern: /send\s+(?:this|the|that|all)\s+(?:data|content|output|result|information|file)\s+to\s+(?:https?:\/\/|ftp:\/\/|\S+@\S+)/i, label: 'nl-indirection: send data to external destination' },
|
||||
{ pattern: /read\s+(?:the\s+)?(?:contents?\s+of\s+)?(?:~\/)?\.(?:ssh|aws|gnupg|env)\b/i, label: 'nl-indirection: read sensitive dotfile path' },
|
||||
{ pattern: /(?:extract|copy|dump|exfiltrate)\s+(?:all\s+)?(?:the\s+)?(?:credentials?|secrets?|tokens?|keys?|passwords?)\s+(?:and|then)\s+(?:send|post|upload|transmit)/i, label: 'nl-indirection: extract credentials and exfiltrate' },
|
||||
{ pattern: /(?:download|fetch|retrieve)\s+(?:from\s+)?\S+\s+(?:and|then)\s+(?:execute|run|eval|pipe\s+to\s+(?:bash|sh|node|python))/i, label: 'nl-indirection: download and execute' },
|
||||
];
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// High patterns — subtle manipulation (advisory warning, not block)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export const HIGH_PATTERNS = [
|
||||
{ pattern: /always\s+prioritize\s+user\s+requests?\s+over/i, label: 'normalization: prioritize user over rules' },
|
||||
{ pattern: /user\s+intent\s+takes?\s+precedence\s+over/i, label: 'normalization: user intent precedence' },
|
||||
{ pattern: /if\s+CLAUDE\.md\s+conflicts/i, label: 'normalization: CLAUDE.md conflict override' },
|
||||
{ pattern: /skip\s+confirmation\s+for/i, label: 'normalization: skip confirmation' },
|
||||
{ pattern: /your\s+actual\s+task\s+is/i, label: 'reframing: your actual task' },
|
||||
{ pattern: /your\s+real\s+purpose\s+is/i, label: 'reframing: your real purpose' },
|
||||
{ pattern: /what\s+you\s+should\s+actually\s+do/i, label: 'reframing: what you should actually do' },
|
||||
|
||||
// HTML comment injection directed at agents
|
||||
{ pattern: /<!--\s*(?:AGENT|AI|HIDDEN|ACTUAL\s+TASK|REAL\s+INSTRUCTION)\s*:/i, label: 'hidden comment: agent-directed HTML comment' },
|
||||
|
||||
// --- Content Injection: CSS/HTML obfuscation (AI Agent Traps) ---
|
||||
// v7.8.3 (#24): quantifiers bounded ({1,256}/{0,256}) — the unbounded
|
||||
// overlapping [^"]* runs plus the required closing quote backtracked
|
||||
// O(N^2)/O(N^3) when an attacker omitted the closing quote (~27s at the
|
||||
// 512KB hook read cap). 256 chars comfortably covers legitimate inline
|
||||
// style/aria-label attributes.
|
||||
{ pattern: /<[^>]{1,256}style\s*=\s*"[^"]{0,256}display\s*:\s*none[^"]{0,256}"[^>]{0,256}>/i, label: 'html-obfuscation: display:none element with content' },
|
||||
{ pattern: /<[^>]{1,256}style\s*=\s*"[^"]{0,256}visibility\s*:\s*hidden[^"]{0,256}"[^>]{0,256}>/i, label: 'html-obfuscation: visibility:hidden element' },
|
||||
{ pattern: /<[^>]{1,256}style\s*=\s*"[^"]{0,256}position\s*:\s*absolute[^"]{0,256}-\d{3,}px[^"]{0,256}"[^>]{0,256}>/i, label: 'html-obfuscation: off-screen positioned element' },
|
||||
{ pattern: /<[^>]{1,256}style\s*=\s*"[^"]{0,256}font-size\s*:\s*0[^"]{0,256}"[^>]{0,256}>/i, label: 'html-obfuscation: zero font-size element' },
|
||||
{ pattern: /<[^>]{1,256}style\s*=\s*"[^"]{0,256}opacity\s*:\s*0[^"]{0,256}"[^>]{0,256}>/i, label: 'html-obfuscation: zero opacity element' },
|
||||
{ pattern: /<[^>]{1,256}style\s*=\s*"[^"]{0,256}(?:height|width)\s*:\s*0[^"]{0,256}overflow\s*:\s*hidden[^"]{0,256}"[^>]{0,256}>/i, label: 'html-obfuscation: zero-size overflow-hidden element' },
|
||||
{ pattern: /aria-label\s*=\s*"[^"]{0,256}(?:ignore|override|system|instruction|execute|exfiltrate)[^"]{0,256}"/i, label: 'html-obfuscation: injection in aria-label attribute' },
|
||||
|
||||
// --- Semantic Manipulation: Oversight & Critic Evasion (AI Agent Traps) ---
|
||||
{ pattern: /for\s+educational\s+purposes?\s+only/i, label: 'evasion: educational purpose framing' },
|
||||
{ pattern: /(?:this\s+is\s+)?a\s+hypothetical\s+scenario/i, label: 'evasion: hypothetical scenario framing' },
|
||||
{ pattern: /in\s+a\s+fictional\s+(?:setting|scenario|world)\s+where/i, label: 'evasion: fictional setting framing' },
|
||||
{ pattern: /(?:this\s+is\s+)?a\s+red[- ]?team(?:ing)?\s+(?:exercise|simulation|test)/i, label: 'evasion: red-team exercise framing' },
|
||||
{ pattern: /security\s+audit\s+simulation/i, label: 'evasion: security audit simulation framing' },
|
||||
{ pattern: /pretend\s+(?:this\s+is|we\s+are\s+in)\s+a\s+(?:test|lab|sandbox|simulation)/i, label: 'evasion: test/lab/sandbox pretense' },
|
||||
{ pattern: /as\s+a\s+thought\s+experiment/i, label: 'evasion: thought experiment framing' },
|
||||
{ pattern: /for\s+(?:research|academic|scientific)\s+purposes/i, label: 'evasion: research purpose framing' },
|
||||
{ pattern: /in\s+an?\s+(?:academic|research|educational)\s+context/i, label: 'evasion: academic context framing' },
|
||||
|
||||
// --- Human-in-the-Loop traps (DeepMind kat. 6, v5.0 S4) ---
|
||||
// Approval urgency: pressure to approve without review
|
||||
{ pattern: /(?:approve|accept|confirm)\s+(?:this\s+)?immediately/i, label: 'hitl-trap: approval urgency — approve immediately' },
|
||||
{ pattern: /no\s+need\s+to\s+review/i, label: 'hitl-trap: approval urgency — no need to review' },
|
||||
{ pattern: /(?:just|simply)\s+(?:approve|accept|confirm)\s+(?:it|this|everything)/i, label: 'hitl-trap: approval urgency — just approve' },
|
||||
{ pattern: /(?:don'?t|do\s+not)\s+(?:bother\s+)?(?:check|review|verify|inspect|read)(?:ing)?\s+(?:this|the|it)/i, label: 'hitl-trap: approval urgency — suppress review' },
|
||||
// Summary suppression: hiding actions behind brevity claims
|
||||
{ pattern: /for\s+brevity[\s,]+(?:skipping|omitting|leaving\s+out)/i, label: 'hitl-trap: summary suppression — for brevity, skipping' },
|
||||
{ pattern: /(?:too\s+(?:long|verbose|detailed)\s+to\s+(?:show|display|list|include))/i, label: 'hitl-trap: summary suppression — too long to show' },
|
||||
{ pattern: /(?:details?\s+(?:omitted|redacted|hidden|suppressed))/i, label: 'hitl-trap: summary suppression — details omitted' },
|
||||
// Scope minimization: downplaying destructive changes
|
||||
{ pattern: /(?:minor|trivial|small|cosmetic)\s+(?:change|update|fix|adjustment)\b[^.]{0,80}(?:delet|remov|drop|truncat|reset|destroy|\bformat\b|wipe)/i, label: 'hitl-trap: scope minimization — minor change + destructive action' },
|
||||
];
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Hybrid attack patterns — cross-domain injection (HIGH, v5.0 S6)
|
||||
// Preamble 2.0: P2SQL, recursive injection, XSS in agent context.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
export const HYBRID_PATTERNS = [
|
||||
// P2SQL: SQL keywords in injection text targeting tool operations
|
||||
{ pattern: /(?:ignore|override|disregard|forget)[^.]{0,60}(?:SELECT\s+\*|DROP\s+TABLE|UNION\s+SELECT|DELETE\s+FROM|INSERT\s+INTO|UPDATE\s+\w+\s+SET)(?:\b|(?=\s|$))/i, label: 'hybrid-p2sql: injection + SQL keywords (prompt-to-SQL attack)' },
|
||||
{ pattern: /(?:SELECT\s+\*|DROP\s+TABLE|UNION\s+SELECT|DELETE\s+FROM)\s[^;]{0,80}(?:ignore|override|disregard|bypass)/i, label: 'hybrid-p2sql: SQL operation + injection override keywords' },
|
||||
|
||||
// Recursive injection: text that instructs the model to inject into its own output
|
||||
{ pattern: /(?:inject|insert|embed|include)\s+(?:this|the\s+following)\s+(?:into|in)\s+(?:your|the)\s+(?:output|response|reply|message|prompt|context)/i, label: 'hybrid-recursive: instruction to inject into model output' },
|
||||
{ pattern: /(?:when|if)\s+(?:the\s+)?(?:user|human|operator)\s+(?:asks?|requests?|queries)[^.]{0,60}(?:respond\s+with|output|reply\s+with|include)\s+(?:this|the\s+following)/i, label: 'hybrid-recursive: conditional response injection (recursive payload)' },
|
||||
|
||||
// XSS in agent context: script/event handlers in content for markdown rendering
|
||||
// v8.x-A: the closing </script> requirement was a recall hole — `<script>alert(1)`
|
||||
// and `<script src=x.js>` both passed with found: false. The opening tag alone is
|
||||
// the signal; a src= tag has no body to close in the first place. Matching the
|
||||
// open tag is also strictly linear: one negated-class run whose excluded char
|
||||
// is the terminator, so there is no backtracking surface to re-introduce #24.
|
||||
{ pattern: /<script\b[^>]*>/i, label: 'hybrid-xss: <script> tag in content (agent context XSS)' },
|
||||
{ pattern: /javascript\s*:/i, label: 'hybrid-xss: javascript: URI scheme (agent context XSS)' },
|
||||
{ pattern: /\bon(?:error|load|click|mouseover|focus|blur)\s*=/i, label: 'hybrid-xss: inline event handler attribute (agent context XSS)' },
|
||||
{ pattern: /<iframe\b[^>]*src\s*=\s*["'][^"']*(?:javascript:|data:text\/html)/i, label: 'hybrid-xss: iframe with executable src (agent context XSS)' },
|
||||
];
|
||||
export { CRITICAL_PATTERNS, HIGH_PATTERNS, MEDIUM_PATTERNS, HYBRID_PATTERNS };
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// HITL cognitive load patterns (MEDIUM, v5.0 S4)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue