Repository navigation
fix(security): strengthen prompt-injection nd backtick defenses - #23221
likhith-adithya wants to merge 9 commits into
Conversation
…mini#23045) Co-authored-by: Sri Pasumarthi <sripas@google.com> Co-authored-by: Sri Pasumarthi <111310667+sripasg@users.noreply.github.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security posture of the system by implementing robust defenses against prompt injection attacks. It introduces a new utility for detecting various malicious patterns and integrates this detection into the file reading process. The changes ensure that potentially harmful content is identified, wrapped with clear security warnings, and isolated, thereby preventing instruction overrides, tool call injections, and command substitutions. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new prompt injection detection utility (prompt-injection-detector.ts) that scans LLM-generated content for suspicious patterns like instruction overrides, system prompt markers, and apparent tool calls. This utility is integrated into the ReadFile tool to wrap suspicious content with a security warning. Review comments highlight two critical vulnerabilities in the newly added regex patterns: the backtick substitution pattern ([^]+) should remove its length limit to prevent command injection via large payloads, and the $(...)shell command substitution pattern requires thes` (dotAll) flag to prevent multi-line bypasses.
Note: Security Review did not run due to the size of the PR.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces significant security enhancements against prompt injection attacks by adding detection heuristics and content wrapping for files read by the read_file tool. The changes are well-structured, with the core logic encapsulated in a new prompt-injection-detector.ts utility. The defenses for fence-jumping and header injection are good additions. I've found one potential bypass in the regex for backtick command detection that should be addressed.
Note: Security Review did not run due to the size of the PR.
|
Hi there! Thank you for your interest in contributing to Gemini CLI. To ensure we maintain high code quality and focus on our prioritized roadmap, we have updated our contribution policy (see Discussion #17383). We only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'. All other community pull requests are subject to closure after 14 days if they do not align with our current focus areas. For this reason, we strongly recommend that contributors only submit pull requests against issues explicitly labeled as 'help-wanted'. This pull request is being closed as it has been open for 14 days without a 'help wanted' designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding and for being part of our community! |
Summary
This PR resolves the prompt-injection vulnerabilities outlined in #23114, specifically patching the Command Injection via Backtick Substitution flaw.
It improves upon a previously closed attempt (#23170) by implementing the necessary security fixes caught during review:
Backtick Fix: Removed the regex length limit (/[^]+/`) to catch all legacy backtick substitutions regardless of payload size.
Multi-line Substitution: Added the dotAll (s) flag to the $(...) regex to prevent bypasses utilizing line breaks.
Fence-Jumping Defense: Escaped static fence markers in user content to prevent attackers from breaking out of the isolation block.
FilePath Sanitization: Sanitized the filePath parameter to prevent attackers from injecting into the warning header via malicious file naming.
Fixes #23114
This replaces PR #23213 with a clean commit history to pass the Google CLA check.