P2 "Hidden Instructions" rule produces false positives due to missing word boundary on GET

[nikolay-kolarov]

Issue

The P2 pattern in static_patterns_prompt_injection.py (line 52) matches GET case-insensitively without a word boundary:

(r"<!--.*?(?:system|instructions?|ignore|POST|GET|send|transmit).*?-->", 0.7),

Result

This causes false positives in two scenarios:

1. Substring match — common words containing "get"

For example any HTML comment containing the word target will trigger the rule because the regex matches the substring get inside target.

Example:

<!-- Minimum touch target size for button controls -->

This fires at 70% confidence despite no malicious intent.

2. Multi-comment spanning

The regex can span across multiple HTML comments, treating everything between the first <!-- and a distant --> as a single match. This means it picks up get from completely unrelated code like document.getElementById(...) in between.

Example:

<!-- Section header -->
<button id="openBtn">Open</button>
<script>
document.getElementById("openBtn").addEventListener("click", handler);
</script>
<!-- End of section -->

The entire block is flagged as a single match.

Suggested fix:

Add \b word boundaries:

(r"<!--.*?(?:\bsystem\b|\binstructions?\b|\bignore\b|\bPOST\b|\bGET\b|\bsend\b|\btransmit\b).*?-->", 0.7),

[jayanth922]

I would like to take this issue