mirror of
https://github.com/github/codeql.git
synced 2026-06-21 12:51:08 +02:00
e7a0fc7140
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
18 lines
575 B
Python
18 lines
575 B
Python
from flask import Flask, request
|
|
from agents import Agent
|
|
from guardrails import GuardrailAgent
|
|
|
|
@app.route("/parameter-route")
|
|
def get_input():
|
|
input = request.args.get("input")
|
|
|
|
goodAgent = GuardrailAgent( # GOOD: Agent created with guardrails automatically configured.
|
|
config=Path("guardrails_config.json"),
|
|
name="Assistant",
|
|
instructions="This prompt is customized for " + input)
|
|
|
|
badAgent = Agent(
|
|
name="Assistant",
|
|
instructions="This prompt is customized for " + input # BAD: user input in agent instruction.
|
|
)
|