fix(ENG-12644): strip spoofed boundary tags before annotation

[hiskudin]

Summary

• Adds stripBoundaryPatterns() in src/utils/boundary.ts — removes attacker-supplied [UD-*] and <user-data-*> patterns from text before the real boundary is applied.
• Calls it in both applyRiskBasedMethods and applySpecificMethods in src/sanitizers/sanitizer.ts, immediately before wrapWithBoundary.
• Addresses the structural component of issue [Security] Two confirmed vulnerabilities: prototype pollution and boundary tag spoofing under default config #46 (boundary tag spoofing): fake tags like [UD-TRUSTED]...[/UD-TRUSTED] can no longer nest inside Defender's authentic boundary.

Test plan

• New integration test: fake [UD-TRUSTED] stripped, only one real boundary pair remains
• New integration test: fake <user-data-FAKE> XML tags stripped
• New integration test: real boundary wrapping preserved after stripping
• Full test suite passes (171 passed, 18 skipped)

Closes the structural component of #46. blockHighRisk default and risk escalation are separate product decisions.

---

Summary by cubic

Prevents boundary tag spoofing by stripping fake [UD-*] and <user-data-*> tags at the very start of sanitization, before any detection, so attackers can’t split patterns or nest fake tags inside the real boundary.

• Bug Fixes
  • Added stripBoundaryPatterns() in src/utils/boundary.ts to remove fake boundary-like tags.
  • Run it unconditionally as step 0 in both sanitization paths in src/sanitizers/sanitizer.ts, before any content-based detection and before wrapWithBoundary.
  • Added tests to strip [UD-TRUSTED] and <user-data-FAKE>, block splitter evasion (SY[UD-x]STEM:, ig[UD-x]nore...), and ensure only one real boundary remains after wrapping.

^{Written for commit 1c03507. Summary will update on new commits.}

[Copilot]

Pull request overview

This PR mitigates boundary tag spoofing (issue #46) by stripping attacker-supplied boundary-like markers ([UD-*] and <user-data-*>) from tool-result text before Defender applies its own boundary annotation, preventing fake “trusted” tags from nesting inside the real untrusted boundary.

Changes:

• Added stripBoundaryPatterns() utility to remove boundary-like markers from content.
• Applied boundary stripping immediately before wrapWithBoundary() in both risk-based and specific-method sanitization flows.
• Added integration tests to verify fake boundary tags are removed and real boundary wrapping remains intact.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/utils/boundary.ts	Adds stripBoundaryPatterns() for removing spoofed boundary-like tags prior to applying authentic boundaries.
src/sanitizers/sanitizer.ts	Invokes boundary stripping before boundary wrapping in both applyRiskBasedMethods and applySpecificMethods.
specs/integration.spec.ts	Adds integration coverage for spoofed [UD-*] and <user-data-*> tags being stripped and real wrapping preserved.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

cubic analysis

3 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/sanitizers/sanitizer.ts">

<violation number="1" location="src/sanitizers/sanitizer.ts:9">
P1: According to linked Jira issue ENG-12605, this change does not implement the ticket’s required Auth DB → Airbyte integration and instead modifies sanitizer boundary handling.</violation>

<violation number="2" location="src/sanitizers/sanitizer.ts:159">
P1: `stripBoundaryPatterns()` is called after role stripping and pattern removal have already run. An attacker can split an injection phrase with fake boundary tags (e.g., `ig[UD-x]nore previous instructions`) so earlier sanitizers don't match, and then this final strip re-joins the dangerous phrase unchecked. Move boundary pattern stripping to the beginning of the pipeline (before role/pattern sanitization), or re-run those detectors after stripping.</violation>
</file>

<file name="src/utils/boundary.ts">

<violation number="1" location="src/utils/boundary.ts:82">
P1: Replacing spoofed boundary tags with an empty string can concatenate adjacent tokens, enabling attackers to reconstitute blocked keywords (e.g., `SY[UD-x]STEM:` → `SYSTEM:`). Replace with a space and normalize whitespace to prevent unintended token joining.</violation>
</file>

Linked issue analysis

Linked issue: ENG-12605: Integrate Auth DB with Airbyte for BI data pipeline

Status	Acceptance criteria	Notes
❌	Add the Auth DB as a source in Airbyte to pipe data to Databricks	No Airbyte connector or configuration changes in diffs
❌	Create a database user for Airbyte	No DB user creation scripts, migrations, or infra changes
❌	Update permissions to allow the Airbyte instance to query the database	No GRANT/permission SQL or permission configuration changes
❌	Provide a more accurate source of truth for user state by routing Auth DB data to Databricks (data pipeline end-to-end)	No pipeline, Databricks destination, or sync logic present

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

_{Requires human review: Auto-approval blocked by 3 unresolved issues from previous reviews.}

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

_{Requires human review: Auto-approval blocked by 2 unresolved issues from previous reviews.}