Repository navigation
FIX: Refuse saved converters and scorers that would use this server's credentials (part 11) - #4050
Open
varunj-msft wants to merge 367 commits into
Conversation
# Conflicts: # pyrit/registry/registry_recipe_restore.py
# Conflicts: # tests/unit/registry/test_instance_registry.py
…entials The Azure Speech converters and the Azure Content Safety scorer read this server's key when theirs is empty, or else sign in with its Azure identity, and no value turns that off. They now declare that key as a server fallback, so a saved one is refused when it's saved or restored, as saved targets already are. The audio scorers transcribe with this server's Speech settings, and the local refusal classifier scorer can load its model from a folder on this server or download it with this server's Hugging Face sign-in, so those can't be saved. A class that declares no auth modes now supports only api_key in the saved-entry check, as the saveability check already assumed, so a recipe can't pass by adding an auth_mode the class doesn't take.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Duplicate-name checks can reject entries before recording the refusal, allowing launch initializers that catch the error to use a saved entry instead of the intended instance.
1 open issue
What changed in this PR
Extends saved-registry credential safeguards to converters and scorers, building on the target persistence and ownership work in #4025 and #4028. The stacked changes also cover restore reporting, saved-entry conflict protection, and target ownership displays.
Changes:
- Reject saved components that would implicitly use server credentials or unsupported authentication modes.
- Add recipe storage, startup restoration, and protection against launch scripts replacing saved entries.
- Expose target persistence and ownership information, with regression tests and isolated test storage.
| File | Description |
|---|---|
tests/unit/setup/test_targets_initializer.py |
Tests saved-target grouping conflicts. |
tests/unit/setup/test_scorer_initializer.py |
Tests saved-scorer tagging conflicts. |
tests/unit/setup/test_converter_initializer.py |
Tests saved-converter replacement refusal. |
tests/unit/setup/test_configuration_loader.py |
Tests recipe storage configuration. |
tests/unit/registry/test_registry_recipe_storage.py |
Covers recipe storage and validation. |
tests/unit/registry/test_instance_registry.py |
Covers saved-entry guards and metadata. |
tests/unit/registry/test_attack_technique_registry.py |
Tests saved-technique registration conflicts. |
tests/unit/backend/test_scenario_suite_routes.py |
Tests sanitized storage failures. |
tests/unit/backend/test_scenario_suite_execution_service.py |
Tests launch-conflict reporting. |
tests/unit/backend/test_scenario_run_service.py |
Covers saved-entry launch protection. |
tests/unit/backend/test_scenario_preset_routes.py |
Tests sanitized preset storage failures. |
tests/unit/backend/test_runtime_lifecycle.py |
Covers restoration, readiness, and save/apply coordination. |
tests/unit/backend/test_mappers.py |
Tests target origin and ownership mapping. |
tests/unit/backend/test_initializer_service.py |
Tests unreadable initializer storage responses. |
tests/unit/backend/test_auth_middleware.py |
Tests caller object-ID lookup. |
tests/unit/backend/test_api_routes.py |
Covers persistence errors and ownership forwarding. |
tests/unit/backend/test_analytics_benchmark.py |
Verifies benchmark storage isolation. |
tests/unit/backend/conftest.py |
Isolates saved recipes in backend tests. |
tests/end_to_end/conftest.py |
Gives test backends isolated recipe storage. |
test_support/analytics_benchmark.py |
Configures benchmark recipe storage. |
pyrit/setup/initializers/tools.py |
Rejects saved-entry tool-name conflicts. |
pyrit/setup/initializers/targets.py |
Rejects saved-target group-name conflicts. |
pyrit/setup/initializers/scorers.py |
Prevents saved scorers replacing preferred defaults. |
pyrit/setup/configuration_loader.py |
Adds recipe storage configuration. |
pyrit/score/true_false/local_refusal_classifier_scorer.py |
Declares the classifier unsaveable. |
pyrit/score/true_false/audio_true_false_scorer.py |
Declares audio scoring unsaveable. |
pyrit/score/scorer.py |
Adds scorer saveability metadata. |
pyrit/score/float_scale/azure_content_filter_scorer.py |
Declares server credential fallback. |
pyrit/score/float_scale/audio_float_scale_scorer.py |
Declares audio scoring unsaveable. |
pyrit/registry/registry_recipe_storage.py |
Implements per-registry JSON recipe storage. |
pyrit/registry/registry_recipe_rules.py |
Centralizes saved-entry safety checks. |
pyrit/registry/instance_registry.py |
Tracks ownership and saved-entry conflicts. |
pyrit/registry/file_document_storage.py |
Reports unreadable files and sanitizes errors. |
pyrit/registry/components/attack_technique_registry.py |
Supports saved metadata and conflict guards. |
pyrit/prompt_target/websocket_copilot_target.py |
Declares server-account use unsaveable. |
pyrit/prompt_target/prompt_shield_target.py |
Declares credential and destination restrictions. |
pyrit/prompt_target/openai/openai_target.py |
Declares key, header, and endpoint restrictions. |
pyrit/prompt_target/litellm_chat_target.py |
Declares API-key fallback. |
pyrit/prompt_target/hugging_face/hugging_face_chat_target.py |
Declares token fallback and save prohibition. |
pyrit/prompt_target/http_target/http_target.py |
Disallows saving raw HTTP requests. |
pyrit/prompt_target/hack_a_prompt_target.py |
Declares session and cookie fallbacks. |
pyrit/prompt_target/github_copilot_target.py |
Declares GitHub token fallback. |
pyrit/prompt_target/common/prompt_target.py |
Defines target saveability metadata. |
pyrit/prompt_target/azure_ml_chat_target.py |
Declares credential and endpoint restrictions. |
pyrit/prompt_target/azure_blob_storage_target.py |
Declares token and container restrictions. |
pyrit/prompt_target/a2a_target.py |
Declares destinations requiring credential checks. |
pyrit/models/catalog/target.py |
Adds target origin and ownership fields. |
pyrit/models/catalog/registry_recipe.py |
Defines recipes and restore-report models. |
pyrit/models/catalog/__init__.py |
Exports recipe and origin models lazily. |
pyrit/converter/converter.py |
Adds credential-fallback metadata. |
pyrit/converter/azure_speech_text_to_audio_converter.py |
Declares Speech credential fallback. |
pyrit/converter/azure_speech_audio_to_text_converter.py |
Declares Speech credential fallback. |
pyrit/backend/services/scenario_suite_execution_service.py |
Reports saved-entry launch conflicts. |
pyrit/backend/services/scenario_run_service.py |
Detects caught or wrapped replacement refusals. |
pyrit/backend/services/runtime_lifecycle.py |
Restores recipes before declaring readiness. |
pyrit/backend/routes/targets.py |
Forwards ownership and maps save errors. |
pyrit/backend/routes/scenarios.py |
Documents launch conflicts in API responses. |
pyrit/backend/routes/scenario_suites.py |
Sanitizes storage failure logging and responses. |
pyrit/backend/routes/scenario_presets.py |
Sanitizes storage failure logging and responses. |
pyrit/backend/routes/initializers.py |
Handles unreadable custom-script storage. |
pyrit/backend/README.md |
Documents persistence and ownership behavior. |
pyrit/backend/models/targets.py |
Adds persistence validation and saveability fields. |
pyrit/backend/middleware/auth.py |
Exposes the authenticated caller’s object ID. |
pyrit/backend/mappers/target_mappers.py |
Maps target origin and ownership. |
frontend/src/utils/targetOrigin.ts |
Defines target-origin labels. |
frontend/src/utils/registryName.ts |
Suggests valid, available registry names. |
frontend/src/utils/registryName.test.ts |
Tests name validation and suggestions. |
frontend/src/types/index.ts |
Adds persistence and ownership types. |
frontend/src/test-utils/targetFixtures.ts |
Supports origin and ownership fixtures. |
frontend/src/services/errors.ts |
Recognizes typed save refusals. |
frontend/src/services/errors.test.ts |
Tests save-refusal detection. |
frontend/src/components/Config/TargetTable.tsx |
Displays ownership and filters saved targets. |
frontend/src/components/Config/TargetTable.test.tsx |
Covers origin labels and ownership filtering. |
frontend/src/components/Config/TargetTable.styles.ts |
Styles ownership captions and controls. |
frontend/src/components/Config/TargetOriginBadge.tsx |
Displays target-origin badges. |
frontend/playwright.config.ts |
Isolates seeded backend recipe storage. |
frontend/e2e/registry.spec.ts |
Tests saving targets through the GUI. |
frontend/e2e/fixtures/manual_send_backend.py |
Isolates offline fixture recipe storage. |
frontend/e2e/config.spec.ts |
Tests target saving and ownership displays. |
frontend/e2e/_targets.ts |
Extends target mocks with ownership fields. |
doc/gui/0_gui.md |
Explains saved targets and ownership filtering. |
doc/getting_started/pyrit_conf.md |
Documents restore rules and restricted components. |
.pyrit_conf_example |
Adds a recipe storage configuration example. |
Review effort: Balanced
# Conflicts: # pyrit/backend/services/runtime_lifecycle.py # tests/unit/backend/test_runtime_lifecycle.py
# Conflicts: # pyrit/setup/initializers/tools.py # tests/unit/backend/test_scenario_run_service.py # tests/unit/backend/test_scenario_suite_execution_service.py # tests/unit/registry/test_attack_technique_registry.py # tests/unit/registry/test_instance_registry.py # tests/unit/registry/test_registry_recipe_restore.py
create_named_instance checks the name before it builds, and the technique registry checks names case-insensitively before it registers. Both raised the duplicate-name error without recording the clash, so a launch script that caught either one could still leave a saved entry in place of its own. The name check now records the clash itself, as register already did, and the technique check records it too.
# Conflicts: # tests/unit/registry/test_registry_recipe_restore.py
# Conflicts: # pyrit/backend/mappers/target_mappers.py # pyrit/backend/models/targets.py # pyrit/backend/routes/targets.py # pyrit/backend/services/target_service.py # tests/unit/backend/test_api_routes.py # tests/unit/backend/test_mappers.py # tests/unit/backend/test_runtime_lifecycle.py # tests/unit/backend/test_target_service.py # tests/unit/registry/test_instance_registry.py
# Conflicts: # frontend/src/components/Config/CreateTargetDialog.tsx # pyrit/backend/routes/targets.py # pyrit/backend/services/target_service.py # tests/unit/backend/test_target_service.py # tests/unit/registry/test_registry_recipe_rules.py
# Conflicts: # pyrit/converter/azure_speech_audio_to_text_converter.py # pyrit/converter/azure_speech_text_to_audio_converter.py
Saving now refuses what restore can't rebuild: a setting left to the server's environment (each target type declares these, replacing the backend's class-name table) and parameters the create API can't set. A cancelled save finishes or is undone before the cancellation goes on, rollback deletes only the version this save wrote, storage failures log a redacted cause chain, and capability detection keeps the target's origin.
The dialog keeps the type's own reasons from the type list and gets the rest from POST /api/targets/saveability, which runs create's checks and the library's save checks without building or saving anything, so the warning and the save share one policy. The Entra ID endpoint message shows on the Endpoint URL field after it loses focus.
Saved-entry storage failures now pass their traceback through redact_urls, and code scanning flags the scheme pattern as slow on a long run of letters. A scheme is short, so bounding it keeps the match linear.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is one of the changes for saving Registry entries across restarts. It builds on #4028. Until the earlier PRs merge, the diff here also shows their changes.
A saved converter or scorer is rebuilt at every start and shared by everyone using the app, so restore should refuse one that would sign in with this server's own credentials, as it already does for targets (#4025).
AzureContentFilterScorerread this server's key when theirs is empty, or else sign in with its Azure identity, and no value turns that off. They now list that key inserver_fallback_parameters(azure_speech_key,api_key), so the shared saved-entry check refuses them, as it does for targets.AudioTrueFalseScorerandAudioFloatScaleScorertranscribe with this server's Speech settings.LocalRefusalClassifierScorerloads its model from a folder on this server, or downloads it with this server's Hugging Face sign-in. These get anot_saveable_reason, likeWebSocketCopilotTargetandHuggingFaceChatTargetin FIX: Refuse saved targets that would authenticate with a key (part 7) #4025.server_fallback_parametersis now on theConverterandScorerbases, andnot_saveable_reasononScorer, as onPromptTarget.api_keyin the saved-entry check, ascheck_saveable_classalready assumed. A recipe can no longer pass by naming an auth mode its class doesn't take.pyrit_conf.mdlists the converters and scorers that can't be saved yet.Converters and scorers made without saving, and the ones the startup scripts register, aren't checked.
RobloxPiiScorerandLocalViolenceClassifierScorercan still be saved: their models are fixed public ones and nothing a caller sets.Not covered: saving converters and scorers through the API, which is #4051 (part 12). Picking a server credential, or keeping typed keys in a key vault, would let the Speech converters and the Content Safety and audio scorers be saved later.