agent-sanitizer 2.43.10 → 2.43.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.43.10",
+  "version": "2.43.12",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/html.mjs

@@ -2382,7 +2382,16 @@ const RELATIVE_URL_BASE = "http://relative.invalid";
 // code, a signed CSRF nonce), so the value shape cannot separate them from a
 // payload.
 const BENIGN_BLOB_PARAM_RE =
-  /^(?:x-(?:amz|goog|ms|oss|obs)-[a-z0-9-]+|amz-[a-z0-9-]+|utm_[a-z]+|sig|signature|hmac|policy|credential|expires|key-pair-id|se|sp|sr|sv|st|spr|si|skoid|sktid|code|state|cursor|after|before|continuation|continuationtoken|continuation_token|pagetoken|page_token|nexttoken|next_token|gclid|fbclid|dclid|msclkid|gbraid|wbraid|_ga|_gl|mc_eid|mc_cid)$/i;
+  /^(?:x-(?:amz|goog|ms|oss|obs)-[a-z0-9-]+|amz-[a-z0-9-]+|utm_[a-z]+|sig|signature|hmac|policy|credential|expires|key-pair-id|skoid|sktid|code|state|cursor|after|before|continuation|continuationtoken|continuation_token|pagetoken|page_token|nexttoken|next_token|gclid|fbclid|dclid|msclkid|gbraid|wbraid|_ga|_gl|mc_eid|mc_cid)$/i;
+
+// The SHORT-valued companions of a signed-CDN link: Azure SAS carries a version
+// date (`sv`), a resource letter (`sr`), start/expiry timestamps (`st`/`se`), a
+// permissions letter (`sp`), a protocol (`spr`) and a policy id (`si`) beside
+// its one long `sig`. They mark a query as signed-CDN traffic, which is all
+// `allParamsBenign` needs — but a name whose benign value is short must never
+// excuse a BLOB, or renaming the payload to `?sr=<blob>` walks past every check
+// above.
+const BENIGN_SHORT_PARAM_RE = /^(?:se|sp|sr|sv|st|spr|si)$/i;
 
 // matchesSecretHint is a deliberately broad PRE-gate whose bare-keyword arms
 // (`token`, `secret`, `authorization`, …) also match ordinary hyphen/word
@@ -2442,6 +2451,52 @@ function isBase64UrlBlob(value) {
   return BLOB_VALUE_B64URL_RE.test(value) && B64URL_MIXED_RE.test(value);
 }
 
+// `.` and `,` are legal in a URL but sit outside every blob alphabet above, so
+// chunking a payload on them (`aGVsbG8.d29ybGQ.…`) fails each anchored test
+// whole. Rejoining asks how many encoded bytes a component carries rather than
+// whether it is one unbroken token, which is what a beacon answers.
+const BLOB_SEPARATOR_RE = /[.,]/g;
+
+/**
+ * The separator-free residue of `value`, or null when it carried no separator
+ * (the un-chunked case every caller has already tested).
+ * @param {string} value
+ * @returns {string | null}
+ */
+function chunkedBlobResidue(value) {
+  const joined = value.replace(BLOB_SEPARATOR_RE, "");
+  return joined.length === value.length ? null : joined;
+}
+
+/**
+ * True when a PATH SEGMENT is a payload chunked across `.`/`,`.
+ *
+ * The rejoined bytes must carry base64url's character mix — an uppercase letter
+ * AND a digit — which the unbroken test does not demand. Rejoining is what makes
+ * the stricter bar necessary: a batch REST path is a list of separator-joined
+ * identifiers, so `/v1/quotes/AAPL,MSFT,GOOG,…` rejoins into a pure-uppercase
+ * run and `/v1/products/101,102,…` into a pure-digit one, both long enough to
+ * clear the floor and match the un-mixed arm. The mix is what tells bulk-encoded
+ * bytes from a list of names. It costs a chunked single-alphabet payload, which
+ * is the false negative this layer's doctrine says to take.
+ *
+ * Applied to the PATH only. A JWT is natively three dot-separated base64url
+ * segments running 130 to 600+ chars, so on a query value neither shape nor
+ * length separates a chunked payload from an ordinary `?token=<jwt>`; that
+ * residual is pinned as a test rather than left implicit.
+ * @param {string} segment
+ * @returns {boolean}
+ */
+function isChunkedPathBlob(segment) {
+  const joined = chunkedBlobResidue(segment);
+  return (
+    joined !== null &&
+    joined.length > PATH_BLOB_MIN_LEN &&
+    ((PATH_BLOB_RE.test(joined) && B64URL_MIXED_RE.test(joined)) ||
+      isBase64UrlBlob(joined))
+  );
+}
+
 /** @param {string} value @returns {boolean} */
 function isBlobValue(value) {
   return (
@@ -2481,52 +2536,55 @@ function decodedBlobMatch(value) {
  * values, turning a `+`-bearing base64 blob into a space-broken string that the
  * anchored blob regexes would miss.
  * @param {string} qs
- * @returns {Array<[string, string]>}
+ * @returns {Array<[string, string, string]>} [lowercased name, value, RAW (case-preserved) name]
  */
 function rawParams(qs) {
-  /** @type {Array<[string, string]>} */
+  /** @type {Array<[string, string, string]>} */
   const pairs = [];
   for (const pair of qs.split(/[&;]/)) {
     if (!pair) continue;
     const eq = pair.indexOf("=");
-    const name = eq === -1 ? pair : pair.slice(0, eq);
-    // A VALUELESS param carries its payload in the only token it has, so that
-    // token is its candidate value too — `?<blob>`, `?d=<blob>`, and `?<blob>=`
-    // (whose sole `=` is base64 padding) are one channel. The name alone still
-    // goes through BENIGN_BLOB_PARAM_RE.
-    const afterEq = eq === -1 ? "" : pair.slice(eq + 1);
-    const value = afterEq === "" ? pair : afterEq;
-    pairs.push([name.toLowerCase(), value]);
+    const rawName = eq === -1 ? pair : pair.slice(0, eq);
+    const value = eq === -1 ? "" : pair.slice(eq + 1);
+    pairs.push([rawName.toLowerCase(), value, rawName]);
   }
   return pairs;
 }
 
 /**
- * Exfil reason for one URL parameter, or null. A credential-shaped value in any
- * non-allowlisted parameter (reusing the secret-shape gate), or a long
- * base64/hex blob in one. Allowlisted signing/pagination/analytics parameters
- * are skipped entirely (see BENIGN_BLOB_PARAM_RE).
- * @param {string} name  lowercased parameter name
- * @param {string} value RAW (un-decoded) value
+ * Exfil reason for one URL parameter, or null. A credential-shaped or
+ * blob-shaped run in EITHER half of the pair — the value, or the name — in any
+ * non-allowlisted parameter. Testing the name too (not just the value) is what
+ * catches a payload that lands on the wrong side of the `=`: `?<blob>`,
+ * `?<blob>=`, `?<blob>==` (trailing `=`s read as padding) and `?<blob>=x` (any
+ * non-padding tail) are one channel, since the server reads the query string
+ * either way. Allowlisted signing/pagination/analytics parameters are skipped
+ * entirely (see BENIGN_BLOB_PARAM_RE).
+ * @param {string} name    lowercased parameter name, for the allowlist gate
+ * @param {string} value   RAW (un-decoded) value
+ * @param {string} rawName RAW (case-preserved, un-decoded) name
  * @returns {string | null}
  */
-function paramExfilReason(name, value) {
+function paramExfilReason(name, value, rawName) {
   if (BENIGN_BLOB_PARAM_RE.test(name)) return null;
-  // A leaked credential is an OPAQUE, separator-free token. Gate the
-  // secret-shape/digit test on the CONTIGUOUS opaque run(s) of the value, not on
-  // the whole prose value: a benign path-like value (`?redirect=/authorization-
-  // service/…abcdefghij1234567890`) otherwise matches "authorization" in one
-  // place and a 20-char run in another and false-fires. Requiring both on the
-  // SAME run keeps `ghp_…`-style contiguous tokens firing while dropping prose.
-  const opaqueRuns = value.match(OPAQUE_TOKEN_RE);
-  if (
-    opaqueRuns?.some(
-      (run) => VALUE_HAS_DIGIT_RE.test(run) && matchesSecretHint(run),
+  for (const candidate of [rawName, value]) {
+    if (!candidate) continue;
+    // A leaked credential is an OPAQUE, separator-free token. Gate the
+    // secret-shape/digit test on the CONTIGUOUS opaque run(s), not on the whole
+    // prose candidate: a benign path-like value (`?redirect=/authorization-
+    // service/…abcdefghij1234567890`) otherwise matches "authorization" in one
+    // place and a 20-char run in another and false-fires. Requiring both on the
+    // SAME run keeps `ghp_…`-style contiguous tokens firing while dropping prose.
+    const opaqueRuns = candidate.match(OPAQUE_TOKEN_RE);
+    if (
+      opaqueRuns?.some(
+        (run) => VALUE_HAS_DIGIT_RE.test(run) && matchesSecretHint(run),
+      )
     )
-  )
-    return "credential-shaped token in URL parameter";
-  if (isBlobValue(value) || decodedBlobMatch(value))
-    return "suspicious query parameter";
+      return "credential-shaped token in URL parameter";
+    if (isBlobValue(candidate) || decodedBlobMatch(candidate))
+      return "suspicious query parameter";
+  }
   return null;
 }
 
@@ -2547,9 +2605,9 @@ function rawUrlKeywordExfil(url) {
   const qIdx = url.search(/[?#]/);
   if (qIdx === -1) return null;
   for (const segment of url.slice(qIdx + 1).split("#")) {
-    for (const [name, value] of rawParams(segment)) {
+    for (const [name, value, rawName] of rawParams(segment)) {
       if (!KEYWORD_PARAM_NAME_RE.test(name)) continue;
-      const reason = paramExfilReason(name, value);
+      const reason = paramExfilReason(name, value, rawName);
       if (reason) return reason;
     }
   }
@@ -2566,8 +2624,9 @@ function rawUrlKeywordExfil(url) {
  * @returns {boolean}
  */
 function allParamsBenign(parsed) {
-  return rawParams(parsed.search.slice(1)).every(([name]) =>
-    BENIGN_BLOB_PARAM_RE.test(name),
+  return rawParams(parsed.search.slice(1)).every(
+    ([name]) =>
+      BENIGN_BLOB_PARAM_RE.test(name) || BENIGN_SHORT_PARAM_RE.test(name),
   );
 }
 
@@ -2577,14 +2636,14 @@ function allParamsBenign(parsed) {
  * @returns {string | null}
  */
 function checkUrlParams(parsed) {
-  for (const [name, value] of rawParams(parsed.search.slice(1))) {
-    const reason = paramExfilReason(name, value);
+  for (const [name, value, rawName] of rawParams(parsed.search.slice(1))) {
+    const reason = paramExfilReason(name, value, rawName);
     if (reason) return reason;
   }
   // The fragment carries the same `key=value` channel (`#token=…`); a bare
   // anchor (`#section-2`) yields one empty-value param that trips nothing.
-  for (const [name, value] of rawParams(parsed.hash.slice(1))) {
-    const reason = paramExfilReason(name, value);
+  for (const [name, value, rawName] of rawParams(parsed.hash.slice(1))) {
+    const reason = paramExfilReason(name, value, rawName);
     if (reason) return reason;
   }
   return null;
@@ -2599,8 +2658,9 @@ function checkUrlParams(parsed) {
 function checkUrlPath(parsed) {
   for (const segment of parsed.pathname.split("/")) {
     if (
-      segment.length > PATH_BLOB_MIN_LEN &&
-      (PATH_BLOB_RE.test(segment) || isBase64UrlBlob(segment))
+      (segment.length > PATH_BLOB_MIN_LEN &&
+        (PATH_BLOB_RE.test(segment) || isBase64UrlBlob(segment))) ||
+      isChunkedPathBlob(segment)
     )
       return "encoded data blob in path segment";
   }