Skip to content

fix(ai-prompt-guard): check embeddings string arrays before forwarding - #14073

Open
ruanweihong-aaa wants to merge 3 commits into
apache:masterfrom
ruanweihong-aaa:codex/ai-prompt-guard-array-fix
Open

ruanweihong-aaa wants to merge 3 commits into
apache:masterfrom
ruanweihong-aaa:codex/ai-prompt-guard-array-fix

Conversation

@ruanweihong-aaa

@ruanweihong-aaa ruanweihong-aaa commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Description

When ai-prompt-guard selects no messages, it returns an empty HTTP 200
without forwarding the request upstream.

PR #14006 fixes this early termination, but embeddings string arrays
still skip inspection because get_messages only extracts string inputs.
For example, with deny_patterns: ["secret"], the batch
{"input": ["secret", "hello"]} would be forwarded without being checked.

This PR:

  • Continues request processing when no messages are selected.
  • Reuses the existing embeddings text extractor to check all strings in
    a batch, keeping them together so the default last-message filter
    cannot discard earlier items.
  • Adds regression tests in a separate file.
  • Updates the English and Chinese documentation.

This follows the fix proposed in #14006 and addresses @Baoyuantop's
comments about array inspection and splitting the test file.

Fixes #13944.

Compatibility

No configuration changes are required. String inputs and chat
role/history filtering retain their existing behavior.

Embeddings string arrays now undergo the configured allow/deny checks.
Batch strings are joined with spaces and checked together: allow
patterns apply to the combined text, and any deny-pattern match rejects
the request.

Token-ID arrays are not decoded or inspected. Recognized requests with
no selected text continue processing even with fail_mode: "error",
which applies to unrecognized protocols.

Validation

  • New regression tests: 52 assertions pass; the same tests fail
    15 assertions against unmodified master.
  • Existing ai-prompt-guard tests: 170 assertions pass.
  • Real HTTP tests with a local mock upstream: 23 direct-upstream cases
    and 11 ai-proxy cases pass.
  • Changed-file Lua lint, test formatting, and git diff --check pass.
  • Full repository CI has not been run.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: ai-prompt-guard returns an empty 200 instead of proxying when no content is selected for checking

1 participant