thzxx
1d185db6b3
- Electron + React + TypeScript 架构 - 三栏布局: Sidebar | ChatPanel | DetailPanel - 9 个内置工具 (文件系统/网络/记忆/命令) - SQLite 持久化 (better-sqlite3) - MUI 暗色/亮色主题系统 - Agent Loop ReAct 状态机引擎 - DeepSeek / Agnes AI / Ollama Provider 适配器 - MCP 协议集成 - 系统托盘 + 全局快捷键 - Tailwind CSS v4 + Tailwind Merge - 修复: Sidebar 缺失 TextField 导入导致黑屏
89 lines
2.9 KiB
TypeScript
89 lines
2.9 KiB
TypeScript
/**
|
|
* Prompt Injection Defense — 提示注入防护系统
|
|
*
|
|
* 三层防御：
|
|
* 1. 正则快速过滤
|
|
* 2. 语义级检测（可选）
|
|
* 3. 指令隔离标记
|
|
*
|
|
* @see docs/生产级通用 AI Agent 智能体桌面应用：完整设计与构建指南.html — 第十章
|
|
*/
|
|
|
|
export interface InjectionDetectionResult {
|
|
isInjection: boolean;
|
|
riskScore: number; // 0-10
|
|
findings: InjectionFinding[];
|
|
recommendation: string;
|
|
}
|
|
|
|
export interface InjectionFinding {
|
|
pattern: string;
|
|
matched: string;
|
|
severity: 'low' | 'medium' | 'high';
|
|
}
|
|
|
|
export class PromptInjectionDefender {
|
|
private static INJECTION_PATTERNS = [
|
|
/ignore\s+(all\s+)?(previous|above|prior)\s+(instructions|commands|directives)/i,
|
|
/forget\s+(everything|all\s+(of\s+)?(the|your)|above)/i,
|
|
/you\s+are\s+now/i,
|
|
/new\s+(instructions|directive|role|persona)/i,
|
|
/override\s+your\s+/i,
|
|
/(show|display|print|output|reveal|tell\s+me)\s+(your|the)\s+(system\s+)?(prompt|instruction|directive)/i,
|
|
/(dump|echo|log|expose)\s+(your|the)\s+(context|memory|history)/i,
|
|
/-{3,}\s*(system|user|assistant|instruction)/i,
|
|
/<{3,}(system|instruction|prompt)/i,
|
|
/\[{3,}(system|instruction|prompt)/i,
|
|
/base64\s*:?\s*[A-Za-z0-9+/=]{20,}/i,
|
|
/pretend\s+(you\s+are|to\s+be)/i,
|
|
/act\s+as\s+(if\s+you\s+were|you're)/i,
|
|
/DAN\s*[:\[]/i,
|
|
/JAILBREAK/i,
|
|
];
|
|
|
|
detect(input: string): InjectionDetectionResult {
|
|
const findings: InjectionFinding[] = [];
|
|
let riskScore = 0;
|
|
|
|
for (const pattern of PromptInjectionDefender.INJECTION_PATTERNS) {
|
|
const matches = input.match(pattern);
|
|
if (matches) {
|
|
findings.push({
|
|
pattern: pattern.source,
|
|
matched: matches[0],
|
|
severity: this.classifySeverity(pattern.source),
|
|
});
|
|
riskScore += this.classifySeverity(pattern.source) === 'high' ? 3 :
|
|
this.classifySeverity(pattern.source) === 'medium' ? 2 : 1;
|
|
}
|
|
}
|
|
|
|
return {
|
|
isInjection: findings.length > 0,
|
|
riskScore: Math.min(10, riskScore),
|
|
findings,
|
|
recommendation: this.getRecommendation(riskScore),
|
|
};
|
|
}
|
|
|
|
private classifySeverity(pattern: string): 'low' | 'medium' | 'high' {
|
|
const highRiskKeywords = ['ignore', 'forget', 'jailbreak', 'DAN', 'override', 'new\\s+instruction'];
|
|
const mediumRiskKeywords = ['reveal', 'dump', 'pretend', 'act\\s+as'];
|
|
|
|
for (const kw of highRiskKeywords) {
|
|
if (new RegExp(kw, 'i').test(pattern)) return 'high';
|
|
}
|
|
for (const kw of mediumRiskKeywords) {
|
|
if (new RegExp(kw, 'i').test(pattern)) return 'medium';
|
|
}
|
|
return 'low';
|
|
}
|
|
|
|
private getRecommendation(score: number): string {
|
|
if (score >= 7) return 'BLOCK: High-risk injection detected';
|
|
if (score >= 4) return 'WARN: Suspicious patterns found';
|
|
if (score >= 1) return 'LOG: Minor suspicious patterns detected';
|
|
return 'PASS: No injection patterns detected';
|
|
}
|
|
}
|