chore(ci): harden Gemini issue triage against prompt injection - #992
Open
kikoso wants to merge 1 commit into
Open
chore(ci): harden Gemini issue triage against prompt injection#992kikoso wants to merge 1 commit into
kikoso wants to merge 1 commit into
Conversation
Issue titles and bodies are untrusted input that flows into the Gemini prompts used for triage labeling and auto-answering, so a crafted issue can steer the model output that drives label application. This change limits the blast radius: - Validate model output against an exact allowlist of the five priority labels; drop anything else, including non-strings and labels containing newlines or extra whitespace. - Strip newlines before writing to GITHUB_OUTPUT so script output cannot inject additional output keys. - Wrap the untrusted issue content in delimiters in both triage and answer prompts and instruct the model to treat it as data only. - Add a per-issue concurrency group with cancel-in-progress so rapid edit loops cannot stack Gemini API calls. Claude-Session: https://claude.ai/code/session_01DMAbzVdHqDdyoCKpub2bTC
Contributor
Code Coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:
Description
We received an external security report noting that issue titles and bodies flow untrusted into the Gemini prompts used by the issue triage workflow, so a crafted issue can steer the model output that drives label application (prompt injection). The practical impact is limited (the workflow already only applies one
priority:*label to the triggering issue), but this PR tightens the trust boundary:triage_issue.pyagainst an exact allowlist of the five priority labels. Non-strings are dropped, whitespace and newlines are collapsed before comparison, and anything outside the set is discarded.GITHUB_OUTPUT, so untrusted output cannot inject additional output keys.<issue_content>delimiters in bothtriage_issue.pyandanswer_issue.pyand instruct the model to treat it as data only, ignoring any instructions inside it.cancel-in-progress: true, so rapid edit loops on a single issue cancel the in-flight run instead of stacking Gemini API calls (quota abuse).No library code is touched, so no breaking changes and no release is needed (hence the
chore(ci)prefix). This addresses a privately reported security concern, so there is no public tracking issue. A matching fix for android-maps-utils is in googlemaps/android-maps-utils#1772.https://claude.ai/code/session_01DMAbzVdHqDdyoCKpub2bTC