fix(sanitizer): close case-insensitive scheme and scheme-relative URL bypasses in exfiltration guard#6518
Merged
Merged
Conversation
github-actions
Bot
added
documentation
… bypasses in exfiltration guard ExfiltrationGuard::scan_output's image-URL detection anchored on a literal lowercase https?:// scheme and required an explicit scheme, so uppercase/ mixed-case schemes (HTTPS://evil.com/...) and scheme-relative destinations (//evil.com/...) - both valid and renderer-equivalent to https:// - bypassed detection silently. A backslash-escaped quote in a CommonMark image title also broke the title regex added in #6507. Make scheme matching case-insensitive across all three detection regexes and is_external_url, and treat an optional scheme-relative // prefix as equivalent to an explicit https?://. Tolerate \" as a non-terminating escaped quote in the double-quoted title branch. Fold in the same casing fix for the sibling URL_EXTRACT_RE (tool-URL-injection flagging path); scheme-relative support there is deferred as a larger design change (exact-string flagged-URL-set semantics), marked with a TODO comment. Closes #6508
bug-ops
force-pushed
the
fix/6508-exfil-scheme-bypass
branch
from
July 19, 2026 21:30
8408240 to
2298f7f
Compare
bug-ops
enabled auto-merge (squash)
July 19, 2026 21:30
7 tasks
bug-ops
added a commit
that referenced
this pull request
Jul 19, 2026
… tool-URL flagging path (#6523) URL_EXTRACT_RE required a literal https?: scheme, so a scheme-relative URL (//evil.com/x) in untrusted tool output was never added to the per-turn flagged_urls set and could never be flagged in a later tool call, unlike is_external_url which already treats scheme-relative URLs as external (fixed for scan_output in #6508/#6518). Widening the regex alone would open a second gap: flagged_urls does exact-string matching, so the same origin captured in one textual form would not match its occurrence in the other. URL_EXTRACT_RE now matches an optional scheme, and a new normalize_url_for_matching helper canonicalizes to scheme-relative form for flagged_urls set membership. Normalization is applied only at the flagged_urls-specific build site (sanitize.rs) and at lookup time, keeping extract_flagged_urls itself raw so its other consumer (user_provided_urls, feeding the default-on UrlGroundingVerifier) is unaffected. Closes #6519
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ExfiltrationGuard::scan_output's image-URL detection (MARKDOWN_IMAGE_RE,REFERENCE_DEF_RE,HTML_IMG_RE,is_external_url) anchored on a literal lowercasehttps?://scheme and required an explicit scheme prefix. An uppercase/mixed-case scheme (HTTPS://evil.com/pixel.gif) or a scheme-relative destination (//evil.com/pixel.gif) — both valid CommonMark/HTML5 and rendered identically tohttps://by browsers — bypassed detection entirely.) also broke the title regex added in fix(sanitizer): close exfiltration guard markdown/HTML image regex bypasses #6507.//prefix as equivalent to an explicithttps?://, and tolerating\"as a non-terminating escaped quote in the double-quoted title branch.URL_EXTRACT_RE(the tool-URL-injection flagging path) with the same case-sensitivity issue — folded that casing fix into this PR as well (trivial, same defect class). Scheme-relative support for that specific path is deferred as a larger design change (exact-string flagged-URL-set semantics) and marked with aTODO(critic)comment; a follow-up issue will be filed separately.//).Closes #6508
Test plan
cargo +nightly fmt --check— cleancargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings— cleancargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins— 14713 passed, 35 skipped, 0 failedcargo nextest run --config-file .github/nextest.toml -p zeph-sanitizer— 381 passed (10 new), 0 failedRUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"— cleangitleaks protect --staged— no leaks