Files

Tom Boucher 835dd6ab44 test(3596): adversarial security/prompt-injection abuse suite (#3654 )

* test(3596): adversarial security/prompt-injection abuse suite

Adds `tests/security-prompt-injection.test.cjs` and a fixtures
directory at `tests/fixtures/adversarial/security/` covering the
attack classes enumerated in #3596:

  - Command substitution / backticks / heredoc payloads in workstream
    names — sentinel-file probes prove no shell is spawned, slugifier
    neutralises the input.
  - Path traversal through `--ws` and slash-bearing workstream names —
    rejected with structured `--json-errors` payload, no stack trace,
    no filesystem mutation outside the project root.
  - Fake `<system>` / `[SYSTEM]` / `<<SYS>>` / `[INST]` boundary tags —
    sanitizeForPrompt neutralises every form; structural negative
    property locked across all six styles in one place.
  - Zero-width / bidi-override codepoints — stripped per the documented
    codepoint set; asserted via codePoint inspection, not regex
    literals.
  - Hostile read of CONTEXT.md / PLAN.md / ROADMAP.md fixtures —
    `gsd-read-injection-scanner.js` surfaces the advisory; excluded
    paths and non-Read tools stay silent; malformed JSON does not
    crash the hook.
  - Hostile write of `.planning/` files — `gsd-prompt-guard.js` emits
    a `PreToolUse` advisory; non-Write/Edit tools stay silent.
  - Fake `ghp_*` / `sk-*` env tokens — never echoed in CLI stdout or
    stderr under hostile inputs; covered under
    `// allow-test-rule: structural-regression-guard` because the only
    way to assert byte-level absence is `.includes(token)` against the
    captured streams.
  - `validatePath`, `validateShellArg`, `validatePhaseNumber`,
    `validateFieldName` — focused negative-input contract pins.

Pinned behavior gaps (documented, NOT fixed in this PR):

  - `<instructions>` is intentionally whitelisted by both the scanner
    and the sanitiser (GSD's own prompt scaffolding). Two REGRESSION
    GUARD tests lock that contract.
  - The current `scanForInjection` does NOT flag malicious markdown
    links (javascript:/data:/embedded-credentials URLs). PINNED with
    negative-proof so any future scope extension fails the assertion
    and forces a deliberate update to the acceptance map.
  - `prompt-builder.ts` does not yet wrap plan/context markdown in an
    "untrusted data" envelope. That seam lives on the TS side and is
    covered by `sdk/src/prompt-builder.test.ts`; out of scope for a
    CJS test file. Mentioned in the file header.

Verification:

  - `node --test tests/security-prompt-injection.test.cjs` → 73 tests
    pass.
  - `node scripts/lint-no-source-grep.cjs` → 0 violations across
    546 test files (one `allow-test-rule: structural-regression-guard`
    annotation on this file for the token-absence assertions).
  - `node scripts/run-tests.cjs` → 9730 tests pass, 0 fail.

Refs #3596

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(3596): allow adversarial fixtures in scan + harden graphify status parse

* fix(3596): skip adversarial security fixtures in secret scan

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-17 00:34:53 -04:00

1.3 KiB

Raw Blame History

Adversarial security fixtures (#3596)

Reusable hostile payloads consumed by tests/security-prompt-injection.test.cjs.

The fixtures here are pure data — they are loaded by the test as input to the production code under test (hooks, validators, sanitizers, CLI). They are not executed and contain no real secrets.

File	Attack class	Consumed by
`context-instruction-override.md`	Fake instruction override + role manipulation	gsd-read-injection-scanner.js, gsd-prompt-guard.js
`plan-fake-system-tags.md`	`<system>`/`<assistant>` boundary mimicry	sanitizeForPrompt, gsd-prompt-guard.js
`roadmap-heredoc-breakout.md`	Heredoc-shaped payload inside a planning doc	gsd-read-injection-scanner.js
`plan-fake-frontmatter.md`	Frontmatter fields that try to override intent	gsd-read-injection-scanner.js
`context-malicious-markdown-link.md`	Markdown links with `javascript:` and embedded creds	gsd-read-injection-scanner.js
`context-invisible-unicode.md`	Zero-width chars hiding instructions	gsd-read-injection-scanner.js, sanitizeForPrompt

The fake-token values used in CLI redaction probes (ghp_AAAA…, sk-AAAA…) are constructed inline by the test, not stored here, so an editor or grep that scans this directory does not surface plausible-looking credentials.

1.3 KiB Raw Blame History

Adversarial security fixtures (#3596)

1.3 KiB

Raw Blame History