gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ec261bcbc5795f757704e1e3a03ab4506db423f2
CASAN/AINative_OKR_CASAN5/.specify/scripts/bash/security-check.sh
T
thanhnvandClaude Opus 4.8 ac40c0b281 feat(h4-hardening): Plan-07 Track A — A1 strict semantic, A2 unicode/encoding, A3 tool-output scan 
A1 (V1): CASAN_SECURITY_STRICT=1 makes semantic classification REQUIRED and
  fail-closed — model unavailable/no-verdict → BLOCK, never a silent SKIP.
  Non-strict CASAN_SEMANTIC_CLASSIFY=1 keeps regex verdict but logs
  SEMANTIC_SKIPPED loudly (sourced casan-log.sh). Default (no flags) unchanged.
A2 (V3/V4): unicode-normalize.py (NFKC + zero-width strip + Cyrillic/Greek
  homoglyph fold) and decode-suspicious.py (base64/hex decode + rescan, printable
  filter to avoid false positives) feed new match_either/secret_match haystacks.
  Blocks homoglyph, zero-width, fullwidth, base64/hex-smuggled injection & secrets.
A3 (V7): tool-output-scan.sh scans tool output for injection/secret before it
  re-enters model context; wrapper runs it after H6-exec (mode off|warn|block,
  strict→block). warn is default to preserve benign-draft behaviour.

Baseline preserved: run-casan4 35/35, adversarial 44/44.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-03 22:20:50 +09:00

350 lines
13 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
set -euo pipefail
# CASAN H4 Security Harness
# Usage:
# security-check.sh <input-file> <output-file> [input|output]
#
# input mode: blocks prompt injection / critical secrets, masks PII, writes safe prompt.
# output mode: redacts PII/secrets from generated output, flags risky language, writes safe output.
INPUT_FILE="${1:-}"
OUTPUT_FILE="${2:-}"
MODE="${3:-input}"
if [[ -z "$INPUT_FILE" || -z "$OUTPUT_FILE" ]]; then
echo "Usage: security-check.sh <input-file> <output-file> [input|output]" >&2
exit 64
fi
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
LOG_DIR="$PROJECT_ROOT/.specify/logs"
TRACE_DIR="$LOG_DIR/trace"
AUDIT_DIR="$LOG_DIR/audit"
SECURITY_DIR="$PROJECT_ROOT/.specify/security"
# Shared log taxonomy (error<warn<info<debug<trace via CASAN_LOG_LEVEL). Used to
# make semantic skips loud (never silent) — stderr only, stdout contract intact.
# shellcheck source=casan-log.sh
source "$SCRIPT_DIR/casan-log.sh"
mkdir -p "$TRACE_DIR" "$AUDIT_DIR" "$(dirname "$OUTPUT_FILE")"
if [[ ! -f "$INPUT_FILE" ]]; then
echo "SECURITY_BLOCKED: input file not found: $INPUT_FILE" >&2
exit 1
fi
timestamp() {
date -u +"%Y-%m-%dT%H:%M:%SZ"
}
new_trace_id() {
if command -v uuidgen >/dev/null 2>&1; then
uuidgen | tr '[:upper:]' '[:lower:]'
else
printf 'trace-%s-%s\n' "$(date +%s)" "$$"
fi
}
json_escape() {
python -c 'import json,sys; print(json.dumps(sys.stdin.read()))' 2>/dev/null || sed 's/\\/\\\\/g; s/"/\\"/g'
}
hash_text() {
if command -v sha256sum >/dev/null 2>&1; then
sha256sum | awk '{print $1}'
else
shasum -a 256 | awk '{print $1}'
fi
}
# Normalize text to defeat trivial injection bypasses:
# lowercase, fold common leetspeak to letters, collapse punctuation/whitespace.
# Used ONLY for injection/jailbreak phrase matching, never for PII/secret regexes.
normalize_for_match() {
printf '%s' "$1" \
| tr '[:upper:]' '[:lower:]' \
| tr '013457@$' 'oieastas' \
| tr -c 'a-z0-9' ' ' \
| tr -s ' '
}
load_yaml_values() {
local file="$1"
local key="$2"
[[ -f "$file" ]] || return 0
python - "$file" "$key" <<'PY'
import re
import sys
path, key = sys.argv[1], sys.argv[2]
pattern = re.compile(rf'^\s*{re.escape(key)}:\s*"([^"]+)"\s*$')
with open(path, encoding="utf-8") as f:
for line in f:
match = pattern.search(line)
if match:
print(match.group(1))
PY
}
TRACE_ID="$(new_trace_id)"
TIMESTAMP="$(timestamp)"
CONTENT="$(cat "$INPUT_FILE")"
STATUS="pass"
ACTION="allow"
RISK_LEVEL="low"
MATCHED_RULES=()
BLOCK_PATTERNS=(
"ignore (all |any )?(previous|prior|above|the above|earlier) (instruction|instructions|rule|rules|prompt|prompts|guideline|guidelines)"
"ignore system instruction"
"disregard (all |any |the )?.*(rule|instruction|previous|prior|above|earlier|policy|guideline)"
"forget (all |everything |the |your )?.*(instruction|rule|previous|prior|above)"
"bypass (the )?(system|policy|policies|filter|guardrail|guardrails|rule|rules|safety|restriction|restrictions)"
"override (the )?(policy|policies|rule|rules|system|instruction|instructions|guardrail|safety)"
"you are now"
"act as (an? )?(admin|root|developer|unrestricted|unfiltered|different|evil|dan)"
"act without (any )?(restriction|restrictions|rule|rules|limit|limits|filter|guardrail)"
"pretend (to be|you are|you're) (system|not|no longer|an unrestricted)"
"do anything now"
"enable (dan|developer mode|jailbreak)"
"developer mode"
"reveal (the )?(system|hidden|internal|original) (prompt|instruction|instructions)"
"show (the )?(hidden|internal|system) (instruction|instructions|prompt)"
)
while IFS= read -r pattern; do
[[ -n "$pattern" ]] && BLOCK_PATTERNS+=("$pattern")
done < <(load_yaml_values "$SECURITY_DIR/prompt-filter.yaml" "pattern")
APPROVAL_PATTERNS=(
"delete[[:space:]].*"
"drop table"
"shutdown system"
"export secrets"
"dump database"
)
ALERT_PATTERNS=(
"show all data"
"internal prompt"
"system message"
"hidden instruction"
)
EMAIL_REGEX='[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}'
PHONE_REGEX='(\+?[0-9][0-9 .-]{8,}[0-9])'
PERSONAL_ID_REGEX='\b[0-9]{9,12}\b'
CREDIT_CARD_REGEX='\b([0-9]{4}[- ]?){3}[0-9]{4}\b'
SECRET_REGEX='(API[_-]?KEY|ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN|PASSWORD|JWT[_-]?SECRET|SECRET)[[:space:]]*[:=][[:space:]]*[^[:space:]]+'
PRIVATE_KEY_REGEX='-----BEGIN (RSA |EC )?PRIVATE KEY-----'
DB_CONN_REGEX='(postgres|mysql|mongodb)://[^@[:space:]]+@'
AWS_KEY_REGEX='AKIA[0-9A-Z]{16}'
while IFS= read -r regex; do
case "$regex" in
*API*|*TOKEN*|*PASSWORD*|*SECRET*)
regex="${regex//\\s/[[:space:]]}"
regex="${regex//\\S/[^[:space:]]}"
SECRET_REGEX="$regex"
;;
esac
done < <(load_yaml_values "$SECURITY_DIR/output-policy.yaml" "regex")
lower_content="$(printf '%s' "$CONTENT" | tr '[:upper:]' '[:lower:]')"
NORM_CONTENT="$(normalize_for_match "$CONTENT")"
# Unicode-aware normalization (NFKC + zero-width strip + homoglyph fold) so
# fullwidth/zero-width/Cyrillic-lookalike obfuscation cannot split or disguise
# a blocked phrase (V3). Falls back to the raw content if python is missing.
UNI_CONTENT="$CONTENT"
if command -v python >/dev/null 2>&1; then
UNI_CONTENT="$(printf '%s' "$CONTENT" | python "$SCRIPT_DIR/unicode-normalize.py" 2>/dev/null)"
[[ -n "$UNI_CONTENT" ]] || UNI_CONTENT="$CONTENT"
fi
UNI_NORM_CONTENT="$(normalize_for_match "$UNI_CONTENT")"
# Encoding smuggling (V4): decode embedded base64/hex blobs and expose the
# decoded plaintext so the same block/secret patterns can be re-run on it.
# Only mostly-printable decodes survive, so random base64-looking words never
# create a false positive.
DECODED_CONTENT=""
if command -v python >/dev/null 2>&1; then
DECODED_CONTENT="$(printf '%s' "$CONTENT" | python "$SCRIPT_DIR/decode-suspicious.py" 2>/dev/null || true)"
fi
# Matches a pattern against the raw (case-insensitive), leetspeak-folded,
# unicode-normalized, and decoded-payload views of the content, so leetspeak,
# whitespace/punctuation, homoglyph, zero-width and base64/hex obfuscation
# cannot slip a phrase past the blocklist.
match_either() {
local pattern="$1"
printf '%s' "$CONTENT" | grep -Eiq -- "$pattern" \
|| printf '%s' "$NORM_CONTENT" | grep -Eq -- "$pattern" \
|| printf '%s' "$UNI_CONTENT" | grep -Eiq -- "$pattern" \
|| printf '%s' "$UNI_NORM_CONTENT" | grep -Eq -- "$pattern" \
|| { [[ -n "$DECODED_CONTENT" ]] && printf '%s' "$DECODED_CONTENT" | grep -Eiq -- "$pattern"; }
}
# Secret/PII regex match against the raw content OR any decoded base64/hex
# payload, so a secret smuggled through encoding is still caught (V4). Additive
# only: with no decoded payload this is identical to the previous raw check.
secret_match() {
local regex="$1"
printf '%s' "$CONTENT" | grep -Eiq -- "$regex" \
|| { [[ -n "$DECODED_CONTENT" ]] && printf '%s' "$DECODED_CONTENT" | grep -Eiq -- "$regex"; }
}
if [[ "$MODE" == "input" ]]; then
for pattern in "${BLOCK_PATTERNS[@]}"; do
if match_either "$pattern"; then
STATUS="blocked"
ACTION="block"
RISK_LEVEL="high"
MATCHED_RULES+=("prompt-injection:$pattern")
fi
done
if secret_match "$CREDIT_CARD_REGEX"; then
STATUS="blocked"
ACTION="block"
RISK_LEVEL="high"
MATCHED_RULES+=("pii-credit-card")
fi
if secret_match "$SECRET_REGEX" \
|| secret_match "$PRIVATE_KEY_REGEX" \
|| secret_match "$DB_CONN_REGEX" \
|| secret_match "$AWS_KEY_REGEX"; then
STATUS="blocked"
ACTION="block"
RISK_LEVEL="high"
MATCHED_RULES+=("secret-in-input")
fi
if [[ "$STATUS" != "blocked" ]]; then
for pattern in "${APPROVAL_PATTERNS[@]}"; do
if match_either "$pattern"; then
STATUS="requires_approval"
ACTION="require_approval"
RISK_LEVEL="high"
MATCHED_RULES+=("unsafe-action:$pattern")
fi
done
fi
if [[ "$STATUS" != "blocked" ]]; then
for pattern in "${ALERT_PATTERNS[@]}"; do
if match_either "$pattern"; then
[[ "$RISK_LEVEL" == "low" ]] && RISK_LEVEL="medium"
ACTION="alert"
MATCHED_RULES+=("suspicious:$pattern")
fi
done
fi
# Semantic escalation. The regex layer above catches known phrasings; a
# genuinely novel paraphrase slips through as low-risk, so a still-allowed
# input is routed to the model classifier. Semantic can only ADD a block,
# never remove one. Two modes:
# * CASAN_SECURITY_STRICT=1 — semantic is REQUIRED (V1). If the model is
# unreachable or returns no usable verdict we FAIL CLOSED (block); never a
# silent skip. Off by default so CI without a model stays non-strict.
# * CASAN_SEMANTIC_CLASSIFY=1 (non-strict) — best-effort. On model outage we
# keep the regex verdict but log SEMANTIC_SKIPPED loudly (no silent pass).
SEMANTIC_REQUIRED=0
if [[ "${CASAN_SECURITY_STRICT:-0}" == "1" || "${CASAN_SEMANTIC_CLASSIFY:-0}" == "1" ]]; then
SEMANTIC_REQUIRED=1
fi
if [[ "$STATUS" != "blocked" && "$SEMANTIC_REQUIRED" == "1" ]]; then
SEM_VERDICT=""
if [[ -x "$SCRIPT_DIR/model-router.sh" ]]; then
SEM_JSON="$TRACE_DIR/semantic-$TRACE_ID.json"
"$SCRIPT_DIR/model-router.sh" "$INPUT_FILE" "$SEM_JSON" --role classify >/dev/null 2>&1 || true
if [[ -f "$SEM_JSON" ]]; then
SEM_VERDICT="$(python -c "import json;print(json.load(open('$SEM_JSON')).get('verdict',''))" 2>/dev/null || echo "")"
fi
fi
if [[ "$SEM_VERDICT" == "INJECTION" ]]; then
STATUS="blocked"; ACTION="block"; RISK_LEVEL="high"
MATCHED_RULES+=("semantic-injection")
elif [[ -z "$SEM_VERDICT" ]]; then
# Model unreachable / no usable verdict.
if [[ "${CASAN_SECURITY_STRICT:-0}" == "1" ]]; then
STATUS="blocked"; ACTION="block"; RISK_LEVEL="high"
MATCHED_RULES+=("semantic-strict-unavailable")
casan_log error security "SEMANTIC_STRICT_FAIL_CLOSED trace_id=$TRACE_ID reason=model_unavailable action=block"
else
MATCHED_RULES+=("semantic-unavailable")
casan_log warn security "SEMANTIC_SKIPPED trace_id=$TRACE_ID reason=model_unavailable action=keep_regex_verdict hint=set_CASAN_SECURITY_STRICT=1_to_fail_closed"
fi
fi
fi
fi
SAFE_CONTENT="$CONTENT"
# Policy-driven PII masking (source of truth: pii-rules.yaml). Built-in sed
# masking below remains as defense-in-depth if the policy file is unavailable.
if [[ -f "$SECURITY_DIR/pii-rules.yaml" ]] && command -v python >/dev/null 2>&1; then
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | python "$SCRIPT_DIR/pii-mask.py" "$SECURITY_DIR/pii-rules.yaml")"
fi
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s/$EMAIL_REGEX/***MASKED_EMAIL***/g")"
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s/$PHONE_REGEX/***MASKED_PHONE***/g")"
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s/$PERSONAL_ID_REGEX/***MASKED_ID***/g")"
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s/$SECRET_REGEX/[REDACTED_SECRET]/Ig")"
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s/$PRIVATE_KEY_REGEX/[REDACTED_PRIVATE_KEY]/Ig")"
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s#$DB_CONN_REGEX#[REDACTED_CONNSTRING]://#Ig")"
SAFE_CONTENT="$(printf '%s' "$SAFE_CONTENT" | sed -E "s/$AWS_KEY_REGEX/[REDACTED_AWS_KEY]/Ig")"
if [[ "$MODE" == "output" ]]; then
if printf '%s' "$CONTENT" | grep -Eiq -- "$SECRET_REGEX" \
|| printf '%s' "$CONTENT" | grep -Eiq -- "$PRIVATE_KEY_REGEX" \
|| printf '%s' "$CONTENT" | grep -Eiq -- "$DB_CONN_REGEX" \
|| printf '%s' "$CONTENT" | grep -Eiq -- "$AWS_KEY_REGEX"; then
# output-policy.yaml level4_gate.fail_on: unredacted_secret -> fail closed.
STATUS="blocked"
ACTION="block"
RISK_LEVEL="high"
MATCHED_RULES+=("secret-in-output")
fi
if printf '%s' "$lower_content" | grep -Eq -- "(maybe|might be incorrect|i am not sure|uncertain)"; then
ACTION="flag"
[[ "$RISK_LEVEL" == "low" ]] && RISK_LEVEL="medium"
MATCHED_RULES+=("hallucination-risk-language")
fi
fi
INPUT_HASH="$(printf '%s' "$CONTENT" | hash_text)"
OUTPUT_HASH="$(printf '%s' "$SAFE_CONTENT" | hash_text)"
RULES_JSON="$(printf '%s\n' "${MATCHED_RULES[@]:-}" | python -c 'import json,sys; print(json.dumps([x for x in sys.stdin.read().splitlines() if x]))')"
TRACE_FILE="$TRACE_DIR/security-$TRACE_ID.json"
cat > "$TRACE_FILE" <<EOF
{
"trace_id": "$TRACE_ID",
"timestamp": "$TIMESTAMP",
"harness": "H4-security",
"mode": "$MODE",
"status": "$STATUS",
"action": "$ACTION",
"risk_level": "$RISK_LEVEL",
"matched_rules": $RULES_JSON,
"input_hash": "$INPUT_HASH",
"output_hash": "$OUTPUT_HASH"
}
EOF
printf '{"timestamp":"%s","trace_id":"%s","harness":"H4-security","mode":"%s","status":"%s","action":"%s","risk_level":"%s","input_hash":"%s","output_hash":"%s"}\n' \
"$TIMESTAMP" "$TRACE_ID" "$MODE" "$STATUS" "$ACTION" "$RISK_LEVEL" "$INPUT_HASH" "$OUTPUT_HASH" >> "$AUDIT_DIR/security.jsonl"
if [[ "$STATUS" == "blocked" ]]; then
: > "$OUTPUT_FILE"
echo "SECURITY_BLOCKED trace_id=$TRACE_ID risk=$RISK_LEVEL rules=$RULES_JSON" >&2
exit 2
fi
printf '%s\n' "$SAFE_CONTENT" > "$OUTPUT_FILE"
STATUS_UPPER="$(printf '%s' "$STATUS" | tr '[:lower:]' '[:upper:]')"
echo "SECURITY_${STATUS_UPPER} trace_id=$TRACE_ID risk=$RISK_LEVEL action=$ACTION output=$OUTPUT_FILE"
Reference in New Issue View Git Blame Copy Permalink