Merge branch 'main' into hannahwestra25-adversarial-benchmark-system-prompt

Author: hannahwestra25

doc/code/executor/5_workflow.ipynb

@@ -802,7 +802,7 @@
    "source": [
     "import pathlib\n",
     "\n",
-    "from pyrit.common.path import CONVERTER_SEED_PROMPT_PATH\n",
+    "from pyrit.common.path import CONVERTER_SEED_PROMPT_PATH, DB_DATA_PATH\n",
     "from pyrit.converter import PDFConverter\n",
     "from pyrit.executor.core import StrategyConverterConfig\n",
     "from pyrit.executor.workflow import XPIATestWorkflow\n",
@@ -865,7 +865,12 @@
     "    injection_items=injection_items,  # Inject hidden text\n",
     ")\n",
     "\n",
-    "upload_target = HTTPXAPITarget(http_url=f\"http://localhost:8000/upload/\", method=\"POST\", timeout=180)\n",
+    "upload_target = HTTPXAPITarget(\n",
+    "    http_url=\"http://localhost:8000/upload/\",\n",
+    "    method=\"POST\",\n",
+    "    allowed_upload_directory=DB_DATA_PATH,\n",
+    "    timeout=180,\n",
+    ")\n",
     "\n",
     "http_api_processing_target = HTTPXAPITarget(\n",
     "    http_url=f\"http://localhost:8000/search_candidates/\", method=\"POST\", timeout=180\n",

doc/code/executor/5_workflow.py

@@ -191,7 +191,7 @@ async def processing_callback() -> str:
 # %%
 import pathlib
 
-from pyrit.common.path import CONVERTER_SEED_PROMPT_PATH
+from pyrit.common.path import CONVERTER_SEED_PROMPT_PATH, DB_DATA_PATH
 from pyrit.converter import PDFConverter
 from pyrit.executor.core import StrategyConverterConfig
 from pyrit.executor.workflow import XPIATestWorkflow
@@ -254,7 +254,12 @@ async def processing_callback() -> str:
     injection_items=injection_items,  # Inject hidden text
 )
 
-upload_target = HTTPXAPITarget(http_url=f"http://localhost:8000/upload/", method="POST", timeout=180)
+upload_target = HTTPXAPITarget(
+    http_url="http://localhost:8000/upload/",
+    method="POST",
+    allowed_upload_directory=DB_DATA_PATH,
+    timeout=180,
+)
 
 http_api_processing_target = HTTPXAPITarget(
     http_url=f"http://localhost:8000/search_candidates/", method="POST", timeout=180

frontend/src/components/Initializers/AdditionalInitializers.styles.ts

@@ -85,4 +85,14 @@ export const useAdditionalInitializersStyles = makeStyles({
     flexDirection: 'column',
     gap: tokens.spacingVerticalXXS,
   },
+  srOnly: {
+    position: 'absolute',
+    width: '1px',
+    height: '1px',
+    padding: '0',
+    margin: '-1px',
+    overflow: 'hidden',
+    clip: 'rect(0,0,0,0)',
+    whiteSpace: 'nowrap',
+  },
 })

frontend/src/components/Initializers/InitializerParametersDialog.test.tsx

@@ -84,6 +84,18 @@ describe('InitializerParametersDialog', () => {
     expect(screen.getByTestId('param-label')).toHaveAttribute('type', 'text')
   })
 
+  it('should give each multiselect checkbox its own accessible name', () => {
+    render(
+      <TestWrapper>
+        <InitializerParametersDialog {...baseProps} initializer={allKindsInitializer} />
+      </TestWrapper>,
+    )
+
+    expect(screen.getByRole('group', { name: 'tags' })).toBeInTheDocument()
+    expect(screen.getByRole('checkbox', { name: 'a' })).toBeInTheDocument()
+    expect(screen.getByRole('checkbox', { name: 'b' })).toBeInTheDocument()
+  })
+
   it('shows a no-parameters message and submits null for a parameterless initializer', async () => {
     const user = userEvent.setup()
     const onSubmit = jest.fn().mockResolvedValue(undefined)

frontend/src/components/Initializers/InitializerParametersDialog.tsx

@@ -187,23 +187,28 @@ function ParameterField({ parameter, value, disabled, onChange }: ParameterField
     const selected = Array.isArray(value) ? value : []
     return (
       <Field label={label} hint={parameter.description ?? undefined}>
-        <div className={styles.checkboxGroup} role="group" aria-label={parameter.name}>
-          {(parameter.choices ?? []).map((choice) => (
-            <Checkbox
-              key={choice}
-              id={`param-${parameter.name}-${choice}`}
-              label={choice}
-              checked={selected.includes(choice)}
-              disabled={disabled}
-              onChange={(_, data) => {
-                const next = data.checked
-                  ? [...selected, choice]
-                  : selected.filter((entry) => entry !== choice)
-                onChange(parameter.name, next)
-              }}
-              data-testid={`param-${parameter.name}-${choice}`}
-            />
-          ))}
+        <div className={styles.checkboxGroup} role="group" aria-labelledby={`param-${parameter.name}-group-label`}>
+          <span id={`param-${parameter.name}-group-label`} className={styles.srOnly}>{label}</span>
+          {(parameter.choices ?? []).map((choice) => {
+            const choiceLabelId = `param-${encodeURIComponent(parameter.name)}-${encodeURIComponent(choice)}-label`
+            return (
+              <Checkbox
+                key={choice}
+                id={`param-${parameter.name}-${choice}`}
+                aria-labelledby={choiceLabelId}
+                label={{ children: choice, id: choiceLabelId }}
+                checked={selected.includes(choice)}
+                disabled={disabled}
+                onChange={(_, data) => {
+                  const next = data.checked
+                    ? [...selected, choice]
+                    : selected.filter((entry) => entry !== choice)
+                  onChange(parameter.name, next)
+                }}
+                data-testid={`param-${parameter.name}-${choice}`}
+              />
+            )
+          })}
         </div>
       </Field>
     )

pyproject.toml

@@ -140,7 +140,7 @@ litellm = [
     # platforms cannot be pinned back selectively. 1.91.x is the last line with a
     # universal wheel that installs everywhere. Revisit once litellm ships macOS
     # and musllinux wheels.
-    "litellm>=1.83.0,<1.92.0",
+    "litellm>=1.84.0,<1.92.0",
 ]
 
 # all includes all functional dependencies excluding the ones from the "dev" dependency group
@@ -151,7 +151,7 @@ all = [
     "flask>=3.1.3",
     "ipykernel>=6.29.5",
     "jupyter>=1.1.1",
-    "litellm>=1.83.0,<1.92.0",  # 1.92.0+ drops the universal wheel (no mac/musl/old-glibc/win-arm64); see litellm group
+    "litellm>=1.84.0,<1.92.0",  # 1.92.0+ drops the universal wheel (no mac/musl/old-glibc/win-arm64); see litellm group
     "ollama>=0.5.1",
     "opencv-python>=4.11.0.86",
     "playwright>=1.49.0",

pyrit/prompt_target/http_target/http_target.py

@@ -7,6 +7,7 @@
 import re
 from collections.abc import Callable
 from typing import Any
+from urllib.parse import urlsplit
 
 import httpx
 
@@ -42,6 +43,7 @@ def __init__(
         max_requests_per_minute: int | None = None,
         client: httpx.AsyncClient | None = None,
         model_name: str = "",
+        follow_redirects: bool = True,
         custom_configuration: TargetConfiguration | None = None,
         **httpx_client_kwargs: Any,
     ) -> None:
@@ -58,6 +60,8 @@ def __init__(
             max_requests_per_minute (int, Optional): Maximum number of requests per minute.
             client (httpx.AsyncClient, Optional): Pre-configured httpx client.
             model_name (str): The model name. Defaults to empty string.
+            follow_redirects (bool): Whether to follow HTTP redirects. Defaults to True for backward compatibility;
+                set to False when redirects are unnecessary or the destination must remain fixed.
             custom_configuration (TargetConfiguration, Optional): Override the default configuration for
                 this target instance. Defaults to None.
             **httpx_client_kwargs: Additional keyword arguments for httpx.AsyncClient.
@@ -72,6 +76,7 @@ def __init__(
         # Parse the URL early to use as endpoint identifier
         # This will fail early if the http_request is malformed
         _, _, endpoint, _, _ = self.parse_raw_http_request(http_request)
+        self._destination_origin = self._get_destination_origin(endpoint)
 
         super().__init__(
             max_requests_per_minute=max_requests_per_minute,
@@ -82,6 +87,7 @@ def __init__(
         self.http_request = http_request
         self.callback_function = callback_function
         self.prompt_regex_string = prompt_regex_string
+        self.follow_redirects = follow_redirects
         self.httpx_client_kwargs = httpx_client_kwargs or {}
 
         if client and httpx_client_kwargs:
@@ -99,6 +105,7 @@ def _build_identifier(self) -> ComponentIdentifier:
                 "use_tls": self.use_tls,
                 "prompt_regex_string": self.prompt_regex_string,
                 "callback_function": getattr(self.callback_function, "__name__", None),
+                "follow_redirects": self.follow_redirects,
             },
         )
 
@@ -110,6 +117,7 @@ def with_client(
         prompt_regex_string: str = "{PROMPT}",
         callback_function: Callable[..., Any] | None = None,
         max_requests_per_minute: int | None = None,
+        follow_redirects: bool = True,
     ) -> "HTTPTarget":
         """
         Alternative constructor that accepts a pre-configured httpx client.
@@ -120,6 +128,8 @@ def with_client(
             prompt_regex_string: the placeholder for the prompt
             callback_function: function to parse HTTP response
             max_requests_per_minute: Optional rate limiting
+            follow_redirects: Whether to follow HTTP redirects. Defaults to True for backward compatibility; set to
+                False when redirects are unnecessary or the destination must remain fixed.
 
         Returns:
             HTTPTarget: an instance of HTTPTarget
@@ -130,6 +140,7 @@ def with_client(
             callback_function=callback_function,
             max_requests_per_minute=max_requests_per_minute,
             client=client,
+            follow_redirects=follow_redirects,
         )
 
     def _inject_prompt_into_request(self, request: MessagePiece) -> str:
@@ -142,8 +153,12 @@ def _inject_prompt_into_request(self, request: MessagePiece) -> str:
 
         Returns:
             str: the http request with the prompt added in
+
+        Raises:
+            ValueError: If a multiline prompt would be substituted into the request line or headers.
         """
         re_pattern = re.compile(self.prompt_regex_string)
+        self._validate_prompt_for_template_context(prompt=request.converted_value, pattern=re_pattern)
         if re.search(self.prompt_regex_string, self.http_request):
             http_request_w_prompt = re_pattern.sub(lambda m: request.converted_value, self.http_request)
         else:
@@ -169,6 +184,7 @@ async def _send_prompt_to_target_async(self, *, normalized_conversation: list[Me
         http_request_w_prompt = self._inject_prompt_into_request(request)
 
         header_dict, http_body, url, http_method, http_version = self.parse_raw_http_request(http_request_w_prompt)
+        self._validate_destination(url)
 
         if "Content-Length" in header_dict:
             header_dict["Content-Length"] = str(len(http_body))
@@ -191,15 +207,15 @@ async def _send_prompt_to_target_async(self, *, normalized_conversation: list[Me
                     url=url,
                     headers=header_dict,
                     data=http_body,
-                    follow_redirects=True,
+                    follow_redirects=self.follow_redirects,
                 )
             else:
                 response = await client.request(
                     method=http_method,
                     url=url,
                     headers=header_dict,
                     content=http_body,
-                    follow_redirects=True,
+                    follow_redirects=self.follow_redirects,
                 )
 
             response_content = response.content
@@ -296,3 +312,27 @@ def _infer_full_url_from_host(
 
         host = headers_dict["host"]
         return f"{http_protocol}{host}{path}"
+
+    def _validate_destination(self, url: str) -> None:
+        destination_origin = self._get_destination_origin(url)
+        if destination_origin != self._destination_origin:
+            raise ValueError("Prompt substitution cannot change the configured HTTP destination.")
+
+    def _validate_prompt_for_template_context(self, *, prompt: str, pattern: re.Pattern[str]) -> None:
+        if "\r" not in prompt and "\n" not in prompt:
+            return
+
+        separator = re.search(r"\r?\n\r?\n", self.http_request)
+        header_end = separator.start() if separator else len(self.http_request)
+
+        if any(match.start() < header_end for match in pattern.finditer(self.http_request)):
+            raise ValueError("Prompts substituted into the HTTP request line or headers cannot contain CR or LF.")
+
+    @staticmethod
+    def _get_destination_origin(url: str) -> tuple[str, str | None, int | None]:
+        parsed_url = urlsplit(url)
+        try:
+            port = parsed_url.port
+        except ValueError as exc:
+            raise ValueError(f"Invalid port in HTTP destination: {url}") from exc
+        return parsed_url.scheme.lower(), parsed_url.hostname, port