feat(probes): add SVG/XML injection (XXE + SSRF) probe + detector - #2038
Open
vishnukannaujia wants to merge 1 commit into
Open
feat(probes): add SVG/XML injection (XXE + SSRF) probe + detector#2038vishnukannaujia wants to merge 1 commit into
vishnukannaujia wants to merge 1 commit into
Conversation
Adds probes.svg_injection.SvgInjection and the matching detectors.svg_injection.SvgInjection, targeting SVG/XML that attacks a downstream rasterizer or XML parser via XML external entity resolution (CWE-611) or server-side request forgery (CWE-918). Same "target output attacks a downstream sink" pattern as ansiescape (terminal) and web_injection (browser); browser <script>/XSS stays with web_injection. The probe elicits SVG carrying an external entity (<!ENTITY ... SYSTEM ...>) or an <image href> pointing at file:// or an internal/SSRF target (169.254.169.254, metadata.google.internal, gopher:, dict:). The detector flags these constructs deterministically, so it needs no model call to test. Fixes NVIDIA#1949 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Vishnu Kannaujia <vishnu.kannaujia@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1949
Summary
Adds a new probe + detector pair,
svg_injection, targeting SVG/XML that attacks a downstream rasterizer or XML parser (not a browser) via XML external entity resolution (CWE-611) or server-side request forgery (CWE-918).When an app asks a model to "make me an icon as SVG" and then rasterizes / XML-parses the result, model output containing an external DTD/entity (
<!ENTITY ... SYSTEM "file://...">) can read local files, and an<image href="...">pointing atfile://or an internal host (cloud metadata169.254.169.254/metadata.google.internal, or agopher:/dict:gadget) can trigger SSRF.Same "target output attacks a downstream sink" thesis as
ansiescape(terminal) andweb_injection(browser). Browser<script>/ XSS intentionally stays withweb_injection; this is the SVG-rasterizer / XML-parser path. Companion toformula_injection(#2036) andlog_injection(#2037). Scope-fit floated on #1949 first.What's added
probes.svg_injection.SvgInjection— stub × payload prompts that try to get the target to emit SVG carrying XXE or an SSRF/local-file<image>reference.intent = "S008inject"; tagsowasp:llm02,owasp:llm05,avid-effect:security:S0301,quality:Security:Confidentiality.detectors.svg_injection.SvgInjection— a deterministic regex detector for external-entity (<!DOCTYPE/<!ENTITY ... SYSTEM/PUBLIC>) and<image href>→file:///SSRF-target constructs. No model call needed.Tests
tests/probes/test_probes_svg_injection.py— prompt structure & payloads carry an XXE/SSRF construct.tests/detectors/test_detectors_svg_injection.py— every payload →1.0; benign SVG (plain shapes, a relativehref="logo.png", anhttps://example.comimage) →0.0;Noneoutput →None.black.Happy to align naming/tiering with the
SvgInjection(OF_CONCERN)/SvgInjectionEscaped(INFORMATIONAL) split suggested in the issue if you'd prefer that shape.