mirror of
https://github.com/github/codeql.git
synced 2026-04-02 21:58:19 +02:00
e7a0fc7140
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
13 lines
369 B
YAML
13 lines
369 B
YAML
extensions:
|
|
- addsTo:
|
|
pack: codeql/python-all
|
|
extensible: sinkModel
|
|
data:
|
|
- ['OpenAI', 'Member[beta].Member[assistants].Member[create].Argument[instructions:]', 'prompt-injection']
|
|
|
|
- addsTo:
|
|
pack: codeql/python-all
|
|
extensible: typeModel
|
|
data:
|
|
- ['OpenAI', 'openai', 'Member[OpenAI,AsyncOpenAI,AzureOpenAI].ReturnValue']
|