Skip to content

Commit 6c5c8e1

Browse files
BazookaMusicBazookaMusic
committed
move system prompt injection to non-experimental
1 parent 5ef09a1 commit 6c5c8e1

15 files changed

Lines changed: 111 additions & 13 deletions

File tree

javascript/ql/src/experimental/semmle/javascript/frameworks/Anthropic.qll renamed to javascript/ql/lib/semmle/javascript/frameworks/Anthropic.qll

File renamed without changes.

javascript/ql/src/experimental/semmle/javascript/frameworks/GoogleGenAI.qll renamed to javascript/ql/lib/semmle/javascript/frameworks/GoogleGenAI.qll

File renamed without changes.

javascript/ql/src/experimental/semmle/javascript/frameworks/OpenAI.qll renamed to javascript/ql/lib/semmle/javascript/frameworks/OpenAI.qll

File renamed without changes.

javascript/ql/src/experimental/semmle/javascript/security/PromptInjection/SystemPromptInjectionCustomizations.qll renamed to javascript/ql/lib/semmle/javascript/security/dataflow/SystemPromptInjectionCustomizations.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ private import semmle.javascript.Concepts
1111
private import semmle.javascript.security.dataflow.RemoteFlowSources
1212
private import semmle.javascript.dataflow.internal.BarrierGuards
1313
private import semmle.javascript.frameworks.data.ModelsAsData
14-
private import experimental.semmle.javascript.frameworks.OpenAI
15-
private import experimental.semmle.javascript.frameworks.Anthropic
16-
private import experimental.semmle.javascript.frameworks.GoogleGenAI
14+
private import semmle.javascript.frameworks.OpenAI
15+
private import semmle.javascript.frameworks.Anthropic
16+
private import semmle.javascript.frameworks.GoogleGenAI
1717

1818
/**
1919
* Provides default sources, sinks and sanitizers for detecting

javascript/ql/src/experimental/semmle/javascript/security/PromptInjection/SystemPromptInjectionQuery.qll renamed to javascript/ql/lib/semmle/javascript/security/dataflow/SystemPromptInjectionQuery.qll

File renamed without changes.

javascript/ql/src/experimental/Security/CWE-1427/SystemPromptInjection.qhelp renamed to javascript/ql/src/Security/CWE-1427/SystemPromptInjection.qhelp

File renamed without changes.

javascript/ql/src/experimental/Security/CWE-1427/SystemPromptInjection.ql renamed to javascript/ql/src/Security/CWE-1427/SystemPromptInjection.ql

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,13 @@
44
* @problem.severity error
55
* @security-severity 5.0
66
* @precision high
7-
* @id js/prompt-injection
7+
* @id js/system-prompt-injection
88
* @tags security
9-
* experimental
109
* external/cwe/cwe-1427
1110
*/
1211

1312
import javascript
14-
import experimental.semmle.javascript.security.PromptInjection.SystemPromptInjectionQuery
13+
import semmle.javascript.security.dataflow.SystemPromptInjectionQuery
1514
import SystemPromptInjectionFlow::PathGraph
1615

1716
from SystemPromptInjectionFlow::PathNode source, SystemPromptInjectionFlow::PathNode sink

javascript/ql/src/experimental/Security/CWE-1427/examples/prompt-injection.js renamed to javascript/ql/src/Security/CWE-1427/examples/prompt-injection.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ app.get("/chat", async (req, res) => {
2323
});
2424

2525
res.json(response);
26-
});
26+
});

javascript/ql/src/experimental/Security/CWE-1427/examples/prompt-injection_fixed.js renamed to javascript/ql/src/Security/CWE-1427/examples/prompt-injection_fixed.js

File renamed without changes.

‎javascript/ql/src/experimental/Security/CWE-1427/UserPromptInjection.qhelp‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>If untrusted input is included in a user-role prompt sent to an AI model, an attacker can inject
8+
instructions that manipulate the model's behavior. This is known as <i>indirect prompt injection</i>
9+
when the malicious content arrives through data the model processes, or <i>direct prompt injection</i>
10+
when the attacker controls the prompt directly.</p>
11+
12+
<p>Unlike system prompt injection, user prompt injection targets the user-role messages. Although
13+
user messages are expected to carry user input, passing unsanitized data directly into structured
14+
prompt templates can still allow an attacker to override intended instructions, extract sensitive
15+
context, or trigger unintended tool calls.</p>
16+
</overview>
17+
18+
<recommendation>
19+
<p>To mitigate user prompt injection:</p>
20+
<ul>
21+
<li>Validate user input against a fixed allowlist of permitted values before including it in a prompt.</li>
22+
<li>Use parameterized prompt templates that clearly separate instructions from user data.</li>
23+
<li>Apply output filtering to detect and block responses that indicate prompt injection attempts.</li>
24+
</ul>
25+
</recommendation>
26+
27+
<example>
28+
<p>In the following example, user-controlled data is inserted directly into a user-role prompt
29+
without any validation, allowing an attacker to inject arbitrary instructions.</p>
30+
<sample src="examples/user-prompt-injection.js" />
31+
<p>The fix validates the user input against a fixed allowlist of permitted values before
32+
including it in the prompt.</p>
33+
<sample src="examples/user-prompt-injection_fixed.js" />
34+
</example>
35+
36+
<references>
37+
<li>OWASP: <a href="https://genai.owasp.org/llmrisk/llm01-prompt-injection/">LLM01: Prompt Injection</a>.</li>
38+
<li>MITRE CWE: <a href="https://cwe.mitre.org/data/definitions/1427.html">CWE-1427: Improper Neutralization of Input Used for LLM Prompting</a>.</li>
39+
</references>
40+
41+
</qhelp>

0 commit comments

Comments
 (0)