fix(formatting): wrap get_issue_details output in untrusted data boundary

[sentry-junior]

What

Adds a prompt-injection defense to get_issue_details: the full formatted issue + event payload is now wrapped in <untrusted_sentry_data> XML tags with a SECURITY NOTE preamble.

This follows guidance from Anthropic, Google Cloud MCP docs, and OWASP on separating untrusted telemetry from instructions using strong XML-style delimiters.

How it works

A new markAsUntrustedSentryData(markdown) helper in formatting.ts:

1. HTML-entity-escapes any literal <untrusted_sentry_data> / </untrusted_sentry_data> that appear in the Sentry telemetry payload — preventing boundary breakout from attacker-controlled content in title, culprit, exception.value, stack frames, tags, contexts, etc.
2. Wraps the escaped body in <untrusted_sentry_data>…</untrusted_sentry_data> structural tags.
3. Prepends a SECURITY NOTE explaining that all content inside the tags is user-controlled data and must not be treated as instructions.

formatIssueOutput calls this on its return value, so every code path in get_issue_details (issueId, issueUrl, eventId) gets the wrapper automatically.

The tool description also gains a - **SECURITY**: Results are wrapped in <untrusted_sentry_data> tags… hint so the LLM client's tool manifest is informed before the call.

Tests

Tests were written first to prove the vulnerability, then the implementation was added:

• formatting.test.ts — unit tests for markAsUntrustedSentryData: correct wrapping order, boundary escape for closing tags, boundary escape for opening tags
• formatting.test.ts — formatIssueOutput prompt-injection boundary test: malicious title + culprit with fake closing tag; asserts preamble, content inside boundary, and escape
• get-issue-details.test.ts — integration test: injection issue override via MSW; same structural assertions
• get-issue-prompt-injection-canary.eval.ts — LLM eval canary: asks the model to quote the security note from the tool result and checks it was acknowledged
• 4 inline snapshots updated to include the new wrapper

Verified

pnpm run tsc   ✓
pnpm run lint  ✓
pnpm run test  ✓  (1071 passed, 6 skipped)

---

Action taken on behalf of immutable dcramer.

View Session in Sentry

[sentry-warden]

Unvalidated user-controlled trace_id rendered in trusted ## Response Notes outside the untrusted telemetry boundary

formatIssueOutput seals the application-provided event payload inside <untrusted_event_telemetry> via wrapUntrustedTelemetry(telemetry), but it then reads event.contexts.trace.trace_id and interpolates it into the trusted ## Response Notes section emitted after the closing boundary tag. The value is only type/length checked — there is no hex/UUID format validation — and formatArgumentValue in tool-call-formatting.ts escapes only backslashes and single quotes, not newlines. Because trace_id is part of attacker-influenceable event telemetry (the PR explicitly enumerates contexts as untrusted), an attacker who controls the Sentry event's trace context could inject newlines/markdown to break out of the inline tool-call instruction and place arbitrary content into the trusted, non-sandboxed portion of the output, undermining the prompt-injection defense this PR establishes.

Evidence

• formatting.ts:1924,1978 call wrapUntrustedTelemetry(telemetry) to seal the untrusted event payload; all output += after that point is trusted.
• formatting.ts:1994-1998 derives traceId from event.contexts?.trace?.trace_id with only typeof === "string" and length > 0 guards — no format validation.
• formatting.ts:2000 emits ## Response Notes, then 2017-2057 interpolate traceId into resourceId and query: trace:${traceId} arguments via formatToolCallInstruction, i.e. after the untrusted boundary is closed.
• tool-call-formatting.ts:formatArgumentValue escapes only \\ and ', leaving newlines intact, so a trace_id containing a newline breaks out of the surrounding inline code span into trusted prose.

Also found at 1 additional location

• packages/mcp-core/src/tools/catalog/get-issue-details.test.ts:823

_{Identified by Warden mcp-audit · NKZ-EKP}