Add indirect prompt injection payloads for Issue #13

[yuehua1213]

Summary

• Adds indirect-specific attack descriptions and payload hints for Levels 1-4
• Level 1 includes the obfuscated API_KEY / spaced-key style payload from Issue Create Payload for Indirect Prompt injection #13
• Adds webpage override, hidden HTML comment, and multi-source confusion payloads
• Fixes unresolved locale keys (payload.direct_injection, payload.hidden_content, payload.context_confusion, payload.na) that previously rendered as raw keys
• Adds registry tests so attack-vector keys stay wired and resolve in messages_us.properties

Relation to existing work

Issue #13 already has open PR #22, but it is merge-conflicting / stale. This PR rebuilds the same intent on current main with tests.

Closes #13

Test plan

• Before: new registry tests fail on current main keys
• After: pytest tests/test_indirect_prompt_injection_registry.py -v → 6 passed
• Full suite: pytest tests/ -q → 27 passed

Made with Cursor

Summary by CodeRabbit

• New Features

  • Added localized descriptions and test payloads for indirect prompt-injection scenarios, including obfuscated requests, hidden comments, and multisource confusion.
  • Added a hardened secure scenario that confirms no exploit or secret token is exposed.

• Tests

  • Added coverage verifying attack-vector metadata, localized text, payload mappings, and secure endpoint registration.

[coderabbitai]

Warning

Review limit reached

@yuehua1213, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fff090f8-543e-48ed-8f09-b8734690429b

📥 Commits

Reviewing files that changed from the base of the PR and between c4069f1 and 2c16bac.

📒 Files selected for processing (2)

• src/controllers/indirect_prompt_injection_controller.py
• tests/test_indirect_prompt_injection_registry.py

📝 Walkthrough

Walkthrough

The change adds indirect prompt injection localization strings, maps them to controller levels 1–4, and adds tests for metadata, locale resolution, and secure level 4 registration.

Changes

Indirect prompt injection

Layer / File(s)	Summary
Localized injection metadata locale/messages_us.properties	Adds US English descriptions and payload messages for indirect prompt injection scenarios.
Controller level mapping src/controllers/indirect_prompt_injection_controller.py	Maps levels 1–4 to indirect-specific attack vectors and updates the controller description’s dash characters.
Registry validation tests/test_indirect_prompt_injection_registry.py	Verifies level metadata, localized text resolution, secure level 4 registration, and the absence of a secret token.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes adding indirect prompt injection payloads and identifies Issue #13.
Linked Issues check	✅ Passed	The changes add indirect prompt injection payloads, attack-vector annotations, locale keys, and registry tests requested by Issue #13.
Out of Scope Changes check	✅ Passed	The localization, controller metadata, and registry tests directly support the linked issue and stated pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

tests/test_indirect_prompt_injection_registry.py (1)

47-52: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Assert vulnerability exposure metadata, not only locale keys.

The tests verify descriptions, payloads, Variant.SECURE, and secret_token. They do not verify vulnerability_exposed. The controller requires VulnerabilityType.INDIRECT_PROMPT_INJECTION on Levels 1–3 and an empty list on Level 4. Add these expected exposure lists to the registry assertions.

Also applies to: 75-78

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_indirect_prompt_injection_registry.py` around lines 47 - 52,
Update test_indirect_attack_vectors_use_indirect_specific_keys to include
expected vulnerability exposure metadata in its parameterized inputs and assert
each attack vector’s vulnerability_exposed values. Expect
VulnerabilityType.INDIRECT_PROMPT_INJECTION for Levels 1–3 and an empty list for
Level 4, while preserving the existing description and payload assertions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/controllers/indirect_prompt_injection_controller.py`:
- Around line 26-29: Replace both mojibake `鈥?` sequences in the user-facing
description near the agentic-systems paragraph and the indirect prompt injection
reference title with a valid ASCII hyphen or UTF-8 em dash, preserving the
surrounding HTML and wording.

---

Nitpick comments:
In `@tests/test_indirect_prompt_injection_registry.py`:
- Around line 47-52: Update
test_indirect_attack_vectors_use_indirect_specific_keys to include expected
vulnerability exposure metadata in its parameterized inputs and assert each
attack vector’s vulnerability_exposed values. Expect
VulnerabilityType.INDIRECT_PROMPT_INJECTION for Levels 1–3 and an empty list for
Level 4, while preserving the existing description and payload assertions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a8e4fff-d52c-4bf4-a4be-b9f5bb17d528

📥 Commits

Reviewing files that changed from the base of the PR and between 19fe059 and c4069f1.

📒 Files selected for processing (3)

• locale/messages_us.properties
• src/controllers/indirect_prompt_injection_controller.py
• tests/test_indirect_prompt_injection_registry.py

[yuehua1213]

Addressed CodeRabbit feedback in the latest commit: fixed mojibake dashes in the controller description, and extended registry tests to assert vulnerability_exposed (Levels 1-3 require INDIRECT_PROMPT_INJECTION; Level 4 stays empty). pytest tests/ -q => 27 passed.