3 people 07c338f55d fix(safety): escape tool output XML content and remove misleading sanitized attr (#1067) ...

* fix(safety): escape tool output XML content and remove misleading sanitized attr

The `sanitized="true/false"` attribute on `<tool_output>` misled LLMs into
treating unfiltered content as pre-sanitized. Remove it and add
`escape_xml_content()` to escape `<`, `>`, `&` in tool output body text,
preventing injected XML from breaking the structural boundary.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix(safety): replace contains assertions with exact assert_eq checks

Address Gemini review feedback on PR #1067: replace weak `contains`
assertions with precise `assert_eq!` comparisons in three safety tests
(wrap_for_llm escaping, XML boundary escape, escape_xml_content).

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix: replace full XML escaping with targeted </tool_output escape to preserve JSON content

The previous approach escaped all XML metacharacters (<, >, &) in tool
output, which corrupted JSON content visible to the LLM. This was the
same issue that caused PR #598 to be reverted.

Now only the closing </tool_output sequence is neutralized (via a
zero-width space insertion), matching the pattern already used by
escape_skill_content(). All other content including JSON with angle
brackets and ampersands passes through unchanged.

Also:
- Remove unused _sanitized parameter from wrap_for_llm()
- Add unwrap_tool_output() with reverse escaping for round-trip fidelity
- Add round-trip tests verifying JSON content survives wrap/unwrap
- Update trace_llm test helper to use the new unwrap_tool_output()

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: remove unwrap/expect from escape_tool_output_close to pass CI

Replace regex-based escaping with simple string search to avoid
.unwrap()/.expect() in production code (enforced by CI).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* ci: re-trigger CI with latest changes

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: remove stale 3rd arg from wrap_for_llm bench call

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address PR review - remove stale 3-arg call, add JSON round-trip test

Fix the test_wrap_for_llm_escapes_attr_chars test that still passed a
third `_sanitized` argument to wrap_for_llm (removed in earlier commit).

Add explicit JSON round-trip test with XML metacharacters
({"query": "a < b & c > d"}) confirming they survive wrap/unwrap intact,
as requested in PR #1067 review.

https://claude.ai/code/session_017ckCCurNiBL8uzE4dJg59K

* fix: remove stale sanitized= references from test fixtures, fix clippy warning

Update web/util.rs test fixtures to use the new tool_output format
without the removed sanitized="..." attribute. Remove redundant
#![cfg(test)] in codex_test_helpers.rs (already gated in mod.rs).

https://claude.ai/code/session_01Q4bRgRy96cqfmVPao4XiX8

* test: add round-trip JSON parsing regression gate for PR #598

Adds a test that verifies JSON content with XML metacharacters (<, >, &)
survives the full wrap_for_llm -> unwrap_tool_output -> serde_json::from_str
pipeline intact. This guards against the exact corruption scenario that
motivated reverting full XML escaping in PR #598.

https://claude.ai/code/session_01R2Zt832cV1xxDf7NXNq5GV

* fix(safety): harden wrap_external_content against boundary injection

Address reviewer feedback: apply the same targeted escaping strategy
to wrap_external_content() that was applied to wrap_for_llm(). The
closing delimiter "--- END EXTERNAL CONTENT ---" is now neutralized
in content bodies using a zero-width space, preventing an attacker
from injecting a fake closing delimiter to break out of the wrapper.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

2026-03-21 20:51:03 -07:00

..

safety_check.rs

feat: add Criterion benchmarks for safety layer hot paths (#836)

2026-03-15 03:26:50 +00:00

safety_pipeline.rs

fix(safety): escape tool output XML content and remove misleading sanitized attr (#1067)

2026-03-21 20:51:03 -07:00