mirror of
https://github.com/github/codeql.git
synced 2026-07-15 00:08:14 +02:00
ea87f59480
Add missing system/user prompt-injection sinks across the OpenAI, Anthropic, and Google GenAI JavaScript models: - OpenAI videos.create/edit/extend/remix prompts (user) - OpenAI beta.realtime.sessions.create instructions (system) - Anthropic legacy completions.create prompt (user) - Google GenAI caches.create config.systemInstruction (system) - Google GenAI caches.create config.contents (user) Also reclassify the OpenAI legacy completions.create prompt from system-prompt-injection to user-prompt-injection: the legacy /v1/completions endpoint takes a single free-form prompt with no role separation, so it is the text-in/text-out equivalent of a user message. Note: videos.remix takes the prompt in Argument[1] (remix(videoID, body)), and Google GenAI caches.create nests both contents and systemInstruction under config, so the model entries differ slightly from a naive mapping. Add corresponding test cases with inline annotations and regenerate the .expected files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
98 lines
2.3 KiB
JavaScript
98 lines
2.3 KiB
JavaScript
const express = require("express");
|
|
const { GoogleGenAI } = require("@google/genai");
|
|
|
|
const app = express();
|
|
const ai = new GoogleGenAI({ apiKey: "test-key" });
|
|
|
|
app.get("/test", async (req, res) => {
|
|
const userInput = req.query.userInput; // $ Source
|
|
|
|
// === generateContent with string contents (SHOULD ALERT) ===
|
|
|
|
await ai.models.generateContent({
|
|
model: "gemini-2.0-flash",
|
|
contents: userInput, // $ Alert[js/user-prompt-injection]
|
|
});
|
|
|
|
// === generateContent with user role parts (SHOULD ALERT) ===
|
|
|
|
await ai.models.generateContent({
|
|
model: "gemini-2.0-flash",
|
|
contents: [
|
|
{
|
|
role: "user",
|
|
parts: [
|
|
{
|
|
text: userInput, // $ Alert[js/user-prompt-injection]
|
|
},
|
|
],
|
|
},
|
|
],
|
|
});
|
|
|
|
// === generateContentStream (SHOULD ALERT) ===
|
|
|
|
await ai.models.generateContentStream({
|
|
model: "gemini-2.0-flash",
|
|
contents: userInput, // $ Alert[js/user-prompt-injection]
|
|
});
|
|
|
|
// === generateImages (SHOULD ALERT) ===
|
|
|
|
await ai.models.generateImages({
|
|
model: "imagen-3.0-generate-002",
|
|
prompt: userInput, // $ Alert[js/user-prompt-injection]
|
|
});
|
|
|
|
// === editImage (SHOULD ALERT) ===
|
|
|
|
await ai.models.editImage({
|
|
model: "imagen-3.0-generate-002",
|
|
prompt: userInput, // $ Alert[js/user-prompt-injection]
|
|
});
|
|
|
|
// === generateVideos (SHOULD ALERT) ===
|
|
|
|
await ai.models.generateVideos({
|
|
model: "veo-2.0-generate-001",
|
|
prompt: userInput, // $ Alert[js/user-prompt-injection]
|
|
});
|
|
|
|
// === caches.create: config.contents (SHOULD ALERT) ===
|
|
|
|
await ai.caches.create({
|
|
model: "gemini-2.0-flash",
|
|
config: {
|
|
contents: userInput, // $ Alert[js/user-prompt-injection]
|
|
},
|
|
});
|
|
|
|
// === Constant comparison sanitizer (SHOULD NOT ALERT) ===
|
|
|
|
const userInput2 = req.query.userInput2;
|
|
if (userInput2 === "hello") {
|
|
await ai.models.generateContent({
|
|
model: "gemini-2.0-flash",
|
|
contents: userInput2, // OK - sanitized by constant comparison
|
|
});
|
|
}
|
|
|
|
// === Model role should not be a user prompt sink ===
|
|
|
|
await ai.models.generateContent({
|
|
model: "gemini-2.0-flash",
|
|
contents: [
|
|
{
|
|
role: "model",
|
|
parts: [
|
|
{
|
|
text: userInput, // OK for user-prompt-injection (model role)
|
|
},
|
|
],
|
|
},
|
|
],
|
|
});
|
|
|
|
res.send("done");
|
|
});
|