mirror of
https://github.com/andrewyng/openworker.git
synced 2026-09-03 13:00:37 +00:00
Devika Verma
ed009fd62f
A text-file attachment's contents were flowing verbatim into the reviewer's USER REQUEST block (the list-content extraction kept every text part, and inlined .txt/.csv attachments ARE text parts) - an attacker-writable channel into the judge's highest-authority input, inconsistent with images/PDFs which were dropped silently. New attachments.reviewer_text(): the user's typed words survive, every attachment collapses to '[user attached: <name>]' (images: 'an image'). The reviewer learns a file exists - 'clean this up' plus an attachment IS a different request than 'clean this up' - but never what it says. The agent's view is untouched. A typed message mimicking the inline prefix collapses too: the failure direction is less information, never smuggled content. Prefix and collapser live in the same module so the spelling cannot drift. Corpus: inject-015 (planted upload instruction in an attached csv). Tests: marker collapse, edge shapes, _user_history integration.