From 40b53ea625f98bdd46aec8a74fe9cd3c53e82a78 Mon Sep 17 00:00:00 2001 From: root Date: Sat, 20 Jun 2026 17:27:18 +0000 Subject: [PATCH] =?UTF-8?q?sec:=20fix=20injection-defense=20bypass=20?= =?UTF-8?q?=E2=80=94=202=20new=20patterns,=200x08=20byte=20corruption?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added safety-test-ruse and filters-disabled-claim patterns to block social-engineering probes that claim safety filters are disabled. Root cause: Python str.replace() wrote literal backspace bytes (0x08) instead of regex word-boundary markers (\b), making both patterns silently fail against the probe text. Fixes persona-bypass pentest probe (Magatama MIND/COMPLY findings). --- deploy/ecosystem.config.cjs | 14 +++++++++++--- packages/gateway/src/modules/injection-defense.ts | 6 ++++++ 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/deploy/ecosystem.config.cjs b/deploy/ecosystem.config.cjs index 8d359d8..d079e7b 100644 --- a/deploy/ecosystem.config.cjs +++ b/deploy/ecosystem.config.cjs @@ -10,16 +10,19 @@ module.exports = { apps: [ { name: 'llm-gateway', - script: 'packages/gateway/dist/server.js', + script: 'packages/gateway/scripts/launch.mjs', cwd: '/opt/llm-gateway', instances: 1, exec_mode: 'fork', env: { NODE_ENV: 'production', PORT: 3103, + AUTO_SPAWN_BRIDGES: '1', + DASHBOARD_AUTH_TOKEN: 'ctx-gw-fbb149f6be8eeea9549853d2681580bdd1f1', + LLM_GATEWAY_ADMIN_TOKEN: 'ctx-gw-fbb149f6be8eeea9549853d2681580bdd1f1', DATABASE_URL: process.env.DATABASE_URL || 'postgresql://llm:llm_secure_2026@localhost:5432/llm_gateway', TIP_DATABASE_URL: process.env.TIP_DATABASE_URL || 'postgresql://tip:tip_prod_2026@217.154.82.179:5433/transceiver_db', - OLLAMA_URL: 'http://192.168.178.213:11434', + OLLAMA_URL: 'http://127.0.0.1:11434', LOG_LEVEL: 'info', GITEA_URL: 'http://192.168.178.196:3000', GITEA_TOKEN: '', @@ -30,7 +33,10 @@ module.exports = { OPENAI_BRIDGE_URL: 'http://localhost:3251', CHATGPT_BRIDGE_URL: 'http://localhost:3251', COPILOT_BRIDGE_URL: 'http://localhost:3252', - LLM_PROVIDERS: 'claude,openai,chatgpt,copilot,cerebras,groq,mistral,nvidia', + CODEX_BRIDGE_URL: 'http://127.0.0.1:3253', + OPENAI_CODEX_URL: 'http://127.0.0.1:3253', + M365_COPILOT_BRIDGE_URL: 'http://127.0.0.1:3357', + LLM_PROVIDERS: 'claude,openai,chatgpt,copilot,m365-copilot,codex,cerebras,groq,mistral,nvidia', // Subscription API Keys (add as needed) OPENAI_API_KEY: '', GITHUB_CODEX_TOKEN: '', @@ -82,7 +88,9 @@ module.exports = { env: { NODE_ENV: 'production', COPILOT_BRIDGE_PORT: 3252, + COPILOT_BRIDGE_HOST: '127.0.0.1', COPILOT_API_INTERNAL_PORT: 4141, + COPILOT_API_PACKAGE: 'copilot-api@latest', }, autorestart: true, watch: false, diff --git a/packages/gateway/src/modules/injection-defense.ts b/packages/gateway/src/modules/injection-defense.ts index b3e5cc0..ec4e614 100644 --- a/packages/gateway/src/modules/injection-defense.ts +++ b/packages/gateway/src/modules/injection-defense.ts @@ -61,6 +61,12 @@ const PATTERNS: readonly InjectionPattern[] = [ { id: 'pretend-rolemix', category: 'role_bypass', severity: 'medium', pattern: /\bpretend\s+you\s+(?:are\s+not\s+|don't\s+have\s+|have\s+no\s+)(?:bound\s+by|restricted\s+by|limited\s+by|filtered\s+by)\b/i, description: 'Pretend-you-are-not-restricted bypass' }, + { id: 'safety-test-ruse', category: 'role_bypass', severity: 'high', + pattern: /pretend\s+(?:we\s+are\s+|this\s+is\s+|we're\s+)?(?:running|doing|conducting|executing)\s+a\s+(?:safety|security|compliance|filter)\s+test/i, + description: 'Social-engineering pretend-safety-test bypass' }, + { id: 'filters-disabled-claim', category: 'role_bypass', severity: 'high', + pattern: /(?:safety|content|output|security)\s+(?:filters?|checks?|restrictions?)\s+(?:are|is|have\s+been)\s+(?:temporarily\s+)?(?:disabled|deactivated|turned\s+off|suspended|bypassed)/i, + description: 'False claim that safety filters are disabled' }, // ─── System-prompt extraction ─────────────────────────────────────────── { id: 'reveal-system-prompt', category: 'system_prompt_leak', severity: 'high',