llm-app-security

import re
from dataclasses import dataclass

@dataclass
class InputPolicy:
    max_length: int = 4096
    max_lines: int = 50
    allowed_languages: set = None  # None = all

    def __post_init__(self):
        if self.allowed_languages is None:
            self.allowed_languages = {"en"}

def validate_structure(text: str, policy: InputPolicy) -> tuple[bool, str]:
    """Return (is_valid, reason)."""
    if not text or not text.strip():
        return False, "empty_input"
    if len(text) > policy.max_length:
        return False, f"exceeds_max_length_{policy.max_length}"
    if text.count("\n") > policy.max_lines:
        return False, f"exceeds_max_lines_{policy.max_lines}"
    # Block null bytes and control characters (except newline/tab)
    if re.search(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]", text):
        return False, "contains_control_characters"
    return True, "ok"

import re
from typing import Optional

# Patterns that signal an attempt to override system instructions
INJECTION_PATTERNS = [
    # Direct instruction override
    r"(?i)ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?|rules?)",
    r"(?i)disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?)",
    # System prompt extraction
    r"(?i)(reveal|show|print|output|repeat)\s+(your\s+)?(system\s+prompt|instructions|rules)",
    r"(?i)what\s+(are|were)\s+your\s+(initial\s+)?(instructions|rules|prompt)",
    # Role override
    r"(?i)you\s+are\s+now\s+(a|an|the)\s+",
    r"(?i)(act|behave|respond)\s+as\s+(if\s+)?(you\s+)?(are|were)\s+",
    # Delimiter injection
    r"(?i)<\/?system>",
    r"(?i)\[INST\]|\[\/INST\]",
    r"(?i)###\s*(system|instruction|human|assistant)",
    # Encoding evasion (base64 instructions)
    r"(?i)decode\s+(the\s+)?following\s+(base64|hex|rot13)",
]

_compiled = [re.compile(p) for p in INJECTION_PATTERNS]

def detect_injection(text: str) -> Optional[str]:
    """Return the matched pattern name if injection is detected, else None."""
    for pattern in _compiled:
        match = pattern.search(text)
        if match:
            return pattern.pattern
    return None

const INJECTION_PATTERNS = [
  /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|pro