@highflame/policy 2.2.43 → 2.2.45
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -28,6 +28,21 @@
|
|
|
28
28
|
// Section 1: Prompt injection
|
|
29
29
|
// ---------------------------------------------------------------------------
|
|
30
30
|
|
|
31
|
+
@id("semantic.block-injection-prompt-ml")
|
|
32
|
+
@name("Block prompt injection in LLM prompts (ML)")
|
|
33
|
+
@description("Blocks process_prompt when injection_score >= 75.")
|
|
34
|
+
@severity("critical")
|
|
35
|
+
@tags("category:semantic,threat:injection,detection:ml,surface:process-prompt,owasp:llm01,mitre:atlas-t0051")
|
|
36
|
+
@reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
|
|
37
|
+
forbid (
|
|
38
|
+
principal,
|
|
39
|
+
action == AIGateway::Action::"process_prompt",
|
|
40
|
+
resource
|
|
41
|
+
)
|
|
42
|
+
when {
|
|
43
|
+
context has injection_score && context.injection_score >= 75
|
|
44
|
+
};
|
|
45
|
+
|
|
31
46
|
@id("semantic.block-injection-ml")
|
|
32
47
|
@name("Block injection (ML)")
|
|
33
48
|
@description("Blocks call_tool when injection_score >= 75.")
|
|
@@ -47,6 +62,21 @@ when {
|
|
|
47
62
|
// Section 2: Jailbreak
|
|
48
63
|
// ---------------------------------------------------------------------------
|
|
49
64
|
|
|
65
|
+
@id("semantic.block-jailbreak-prompt-ml")
|
|
66
|
+
@name("Block jailbreak in LLM prompts (ML)")
|
|
67
|
+
@description("Blocks process_prompt when jailbreak_score >= 75.")
|
|
68
|
+
@severity("critical")
|
|
69
|
+
@tags("category:semantic,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02,mitre:atlas-t0054")
|
|
70
|
+
@reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
|
|
71
|
+
forbid (
|
|
72
|
+
principal,
|
|
73
|
+
action == AIGateway::Action::"process_prompt",
|
|
74
|
+
resource
|
|
75
|
+
)
|
|
76
|
+
when {
|
|
77
|
+
context has jailbreak_score && context.jailbreak_score >= 75
|
|
78
|
+
};
|
|
79
|
+
|
|
50
80
|
@id("semantic.block-jailbreak-ml")
|
|
51
81
|
@name("Block jailbreak (ML)")
|
|
52
82
|
@description("Blocks call_tool when jailbreak_score >= 75.")
|
|
@@ -59,6 +59,21 @@ const AI_GATEWAY_SEMANTIC_DEFAULTS_CEDAR = `// =================================
|
|
|
59
59
|
// Section 1: Prompt injection
|
|
60
60
|
// ---------------------------------------------------------------------------
|
|
61
61
|
|
|
62
|
+
@id("semantic.block-injection-prompt-ml")
|
|
63
|
+
@name("Block prompt injection in LLM prompts (ML)")
|
|
64
|
+
@description("Blocks process_prompt when injection_score >= 75.")
|
|
65
|
+
@severity("critical")
|
|
66
|
+
@tags("category:semantic,threat:injection,detection:ml,surface:process-prompt,owasp:llm01,mitre:atlas-t0051")
|
|
67
|
+
@reject_message("Prompt blocked: the ML classifier detected prompt injection with high confidence.")
|
|
68
|
+
forbid (
|
|
69
|
+
principal,
|
|
70
|
+
action == AIGateway::Action::"process_prompt",
|
|
71
|
+
resource
|
|
72
|
+
)
|
|
73
|
+
when {
|
|
74
|
+
context has injection_score && context.injection_score >= 75
|
|
75
|
+
};
|
|
76
|
+
|
|
62
77
|
@id("semantic.block-injection-ml")
|
|
63
78
|
@name("Block injection (ML)")
|
|
64
79
|
@description("Blocks call_tool when injection_score >= 75.")
|
|
@@ -78,6 +93,21 @@ when {
|
|
|
78
93
|
// Section 2: Jailbreak
|
|
79
94
|
// ---------------------------------------------------------------------------
|
|
80
95
|
|
|
96
|
+
@id("semantic.block-jailbreak-prompt-ml")
|
|
97
|
+
@name("Block jailbreak in LLM prompts (ML)")
|
|
98
|
+
@description("Blocks process_prompt when jailbreak_score >= 75.")
|
|
99
|
+
@severity("critical")
|
|
100
|
+
@tags("category:semantic,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02,mitre:atlas-t0054")
|
|
101
|
+
@reject_message("Prompt blocked: the ML classifier detected a jailbreak attempt with high confidence.")
|
|
102
|
+
forbid (
|
|
103
|
+
principal,
|
|
104
|
+
action == AIGateway::Action::"process_prompt",
|
|
105
|
+
resource
|
|
106
|
+
)
|
|
107
|
+
when {
|
|
108
|
+
context has jailbreak_score && context.jailbreak_score >= 75
|
|
109
|
+
};
|
|
110
|
+
|
|
81
111
|
@id("semantic.block-jailbreak-ml")
|
|
82
112
|
@name("Block jailbreak (ML)")
|
|
83
113
|
@description("Blocks call_tool when jailbreak_score >= 75.")
|
package/dist/condition-groups.js
CHANGED
|
@@ -251,11 +251,13 @@ export function expressionToCedar(expr, optionalFields) {
|
|
|
251
251
|
.join(' || ');
|
|
252
252
|
}
|
|
253
253
|
case 'not': {
|
|
254
|
-
|
|
255
|
-
//
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
254
|
+
// Always parenthesized. `!` binds tighter than every operator a
|
|
255
|
+
// leaf renders with, so dropping the parens re-associates the
|
|
256
|
+
// expression: `!context.score > 70` is `(!context.score) > 70`,
|
|
257
|
+
// which the Cedar validator rejects as "expected Bool but saw
|
|
258
|
+
// Long", and `!context has x` is `(!context) has x`. A leaf is not
|
|
259
|
+
// an atom.
|
|
260
|
+
return `!(${expressionToCedar(expr.child, optionalFields)})`;
|
|
259
261
|
}
|
|
260
262
|
case 'raw': {
|
|
261
263
|
if (isValidRawCondition(expr.text)) {
|