Appeng 5697

[RedTanny]

Summary

[APPENG-5697] [T-005] LLM Prompt Injection via Attacker-Controlled CVE Intelligence and Repository Content (Severity: Important, R-003, CTRL-010).

ExploitIQ feeds untrusted content into LLM prompts — CVE intel (NVD/GHSA/Ubuntu), SERP results, target-repo tool output, and patch diffs — with no boundary between data and instructions. An attacker who controls those sources can try to override the agent’s task and manipulate structured outputs / tool inputs (OWASP LLM Top 10 #1).

This PR implements a narrow, execution-route defense: separate untrusted data from instructions, escape delimiter breakouts, and rely on existing Pydantic/with_structured_output schema enforcement. It does not add a large prompt-injection signature database.

1. Core sanitization utility — fence/angle escaping + UUID-bounded READ ONLY DATA wraps.
2. System / prompt hardening — shared SECURITY_INSTRUCTIONS_BLOCK across agent and scoring prompts.
3. Wrap-once at LLM fill — keep strings plain for deterministic logic; wrap only when assembling prompts.

---

Problem

CVE intel enters prompts via build_critical_context / agent pre_process; SERP and source tools inject observations directly; there was no sanitization or boundary enforcement on untrusted blobs before LLM calls.

---

Approach

Principle	Implementation
Data vs. instructions	Wrap untrusted text in --- READ ONLY DATA START/END [UUID] --- (UUID per call)
Delimiter breakouts	Escape ``` and </> before wrapping
Prompt directive	Inject <SECURITY_INSTRUCTIONS> so the model treats wrapped text as analysis data only
Schema enforcement	Existing structured output rejects non-schema jailbreaks
Wrap-once	Plain through filter/empty-check/truncate; wrap immediately before .format(...)

---

Changes

1. sanitization.py — shared utility

• sanitize_untrusted_input() — neutralize markdown fences and angle brackets
• wrap_untrusted_data() — sanitize + UUID boundary markers
• SECURITY_INSTRUCTIONS_BLOCK — imported by prompt sites

2. Intel pipeline & SERP (Phase 3)

• Wrap critical context once after filter+TASK; store [wrapped] in agent state
• Ephemeral wraps for routing / package-filter (pre-state)
• Wrap CVE intel in scoring + checklist prompts; wrap SERP results before return to the LLM
• RPM: wrap CVE description / vendor advisory; security instructions on CVE understanding / code-agent report prompts

3. Prompt hardening (Phases 2 / 4)

SECURITY_INSTRUCTIONS_BLOCK added to reachability/CU system prompts, dispatcher routing, classification, package filter, comprehension, intel scoring, checklist, and RPM checker prompts.

4. Code & agent observations — Narrow scope (Phases 5–6)

Wrap at LLM prompt assembly only:

Field	Sites
{tool_output}	Reachability/CU observation, L1 package-code, L2 build-agent comprehension
{raw_patch_diff}	L1 empty-result classification + comprehension
Patch analysis body	Wrap at fill after truncation

Left plain (by design): ToolMessage.content, observation memory/results, thought-node KNOWLEDGE (already distilled; prefix logic needs plain strings).

---

Deferred / Out of Scope

• L1 thought runtime_prompt FILE_CHANGES / vulnerability-intel wrap (full scope)
• Thought-node KNOWLEDGE join wrap
• Signature-based injection scanners
• Confidence scoring / audit-PVC deployment (threat-model items not required for this control)

---

Testing

• src/vuln_analysis/utils/tests/test_sanitization.py — sanitize + wrap boundaries
• src/vuln_analysis/functions/tests/test_react_internals_pattern_match.py — security block presence
• src/vuln_analysis/utils/tests/test_patch_analysis_prompt.py — wrap / fence escape / truncation still wraps
• tests/test_base_graph_agent.py — comprehension wraps; deterministic post-observation paths stay plain
• Manual E2E: intel pipeline, checklist, scoring, SERP show single READ ONLY DATA wrap; package filter / Go OSV enrichment still work; structured output unaffected
• Manual smoke: reachability/CU + L1 source-grep show wraps around tool/patch blobs

---

Files Changed

File	Change
utils/sanitization.py	New — sanitize/wrap + security block
utils/tests/test_sanitization.py	New
utils/checklist_prompt_generator.py, intel_source_score.py, serp_api_wrapper.py, rpm_checker_prompts.py	Wrap + security instructions
functions/reachability_agent.py, code_understanding_agent.py, cve_agent.py, dispatcher.py, react_internals.py	Hardening + intel wrap-once
functions/base_graph_agent.py, cve_package_code_agent.py, cve_build_agent.py, code_agent_graph_defs.py	Observation/patch wrap-at-fill
tests/test_base_graph_agent.py, utils/tests/test_patch_analysis_prompt.py, functions/tests/test_react_internals_pattern_match.py	Coverage

---

Test plan

• Unit tests above pass
• Spot-check a reachability/CU run: READ ONLY DATA START/END [UUID] around critical context and tool output; security instructions in system/comprehension prompts
• Spot-check L1 package checker: wraps on tool output / patch / patch-analysis prompts; empty-output / truncate paths still behave
• Confirm package filtering and Go OSV enrichment still match on plain strings before wrap
• Confirm structured verdicts still parse (with_structured_output)

[vbelouso]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[RedTanny]

/test-heavy

[RedTanny]

/test-heavy

[RedTanny]

/test-heavy

[RedTanny]

/test-heavy