Repository navigation
FIX: Refuse saved converters and scorers that would use this server's credentials - #4050
Open
varunj-msft wants to merge 152 commits into
Open
varunj-msft wants to merge 152 commits into
varunj-msft wants to merge 152 commits into
Conversation
…API input External construction now rejects a parameter whose type includes Path unless the calling service passes the name in allowed_path_params after making the value safe. The converter service allows its upload parameters once they are stored, and the target service allows the server-set upload folder and the GitHubCopilotTarget working directory. The scorer-only check is removed, and the "Valid parameters" list leaves out path parameters callers cannot set.
The target catalog now applies the path rule to required parameters too, so a target that needs a disallowed path is left out instead of listed without the field, matching the scorer catalog. allowed_path_params is typed frozenset[str] so a bare string cannot turn the allow-list into a substring match.
The target catalog still lists a target whose required path parameter is its server-set upload folder when the server has one, and leaves it out otherwise.
# Conflicts: # tests/unit/backend/test_converter_service.py
…benchmark's recipes folder
…entials The Azure Speech converters and the Azure Content Safety scorer read this server's key when theirs is empty, or else sign in with its Azure identity, and no value turns that off. They now declare that key as a server fallback, so a saved one is refused when it's saved or restored, as saved targets already are. The audio scorers transcribe with this server's Speech settings, and the local refusal classifier scorer can load its model from a folder on this server or download it with this server's Hugging Face sign-in, so those can't be saved. A class that declares no auth modes now supports only api_key in the saved-entry check, as the saveability check already assumed, so a recipe can't pass by adding an auth_mode the class doesn't take.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Duplicate-name checks can reject entries before recording the refusal, allowing launch initializers that catch the error to use a saved entry instead of the intended instance.
1 open issue
What changed in this PR
Extends saved-registry credential safeguards to converters and scorers, building on the target persistence and ownership work in #4025 and #4028. The stacked changes also cover restore reporting, saved-entry conflict protection, and target ownership displays.
Changes:
- Reject saved components that would implicitly use server credentials or unsupported authentication modes.
- Add recipe storage, startup restoration, and protection against launch scripts replacing saved entries.
- Expose target persistence and ownership information, with regression tests and isolated test storage.
| File | Description |
|---|---|
tests/unit/setup/test_targets_initializer.py |
Tests saved-target grouping conflicts. |
tests/unit/setup/test_scorer_initializer.py |
Tests saved-scorer tagging conflicts. |
tests/unit/setup/test_converter_initializer.py |
Tests saved-converter replacement refusal. |
tests/unit/setup/test_configuration_loader.py |
Tests recipe storage configuration. |
tests/unit/registry/test_registry_recipe_storage.py |
Covers recipe storage and validation. |
tests/unit/registry/test_instance_registry.py |
Covers saved-entry guards and metadata. |
tests/unit/registry/test_attack_technique_registry.py |
Tests saved-technique registration conflicts. |
tests/unit/backend/test_scenario_suite_routes.py |
Tests sanitized storage failures. |
tests/unit/backend/test_scenario_suite_execution_service.py |
Tests launch-conflict reporting. |
tests/unit/backend/test_scenario_run_service.py |
Covers saved-entry launch protection. |
tests/unit/backend/test_scenario_preset_routes.py |
Tests sanitized preset storage failures. |
tests/unit/backend/test_runtime_lifecycle.py |
Covers restoration, readiness, and save/apply coordination. |
tests/unit/backend/test_mappers.py |
Tests target origin and ownership mapping. |
tests/unit/backend/test_initializer_service.py |
Tests unreadable initializer storage responses. |
tests/unit/backend/test_auth_middleware.py |
Tests caller object-ID lookup. |
tests/unit/backend/test_api_routes.py |
Covers persistence errors and ownership forwarding. |
tests/unit/backend/test_analytics_benchmark.py |
Verifies benchmark storage isolation. |
tests/unit/backend/conftest.py |
Isolates saved recipes in backend tests. |
tests/end_to_end/conftest.py |
Gives test backends isolated recipe storage. |
test_support/analytics_benchmark.py |
Configures benchmark recipe storage. |
pyrit/setup/initializers/tools.py |
Rejects saved-entry tool-name conflicts. |
pyrit/setup/initializers/targets.py |
Rejects saved-target group-name conflicts. |
pyrit/setup/initializers/scorers.py |
Prevents saved scorers replacing preferred defaults. |
pyrit/setup/configuration_loader.py |
Adds recipe storage configuration. |
pyrit/score/true_false/local_refusal_classifier_scorer.py |
Declares the classifier unsaveable. |
pyrit/score/true_false/audio_true_false_scorer.py |
Declares audio scoring unsaveable. |
pyrit/score/scorer.py |
Adds scorer saveability metadata. |
pyrit/score/float_scale/azure_content_filter_scorer.py |
Declares server credential fallback. |
pyrit/score/float_scale/audio_float_scale_scorer.py |
Declares audio scoring unsaveable. |
pyrit/registry/registry_recipe_storage.py |
Implements per-registry JSON recipe storage. |
pyrit/registry/registry_recipe_rules.py |
Centralizes saved-entry safety checks. |
pyrit/registry/instance_registry.py |
Tracks ownership and saved-entry conflicts. |
pyrit/registry/file_document_storage.py |
Reports unreadable files and sanitizes errors. |
pyrit/registry/components/attack_technique_registry.py |
Supports saved metadata and conflict guards. |
pyrit/prompt_target/websocket_copilot_target.py |
Declares server-account use unsaveable. |
pyrit/prompt_target/prompt_shield_target.py |
Declares credential and destination restrictions. |
pyrit/prompt_target/openai/openai_target.py |
Declares key, header, and endpoint restrictions. |
pyrit/prompt_target/litellm_chat_target.py |
Declares API-key fallback. |
pyrit/prompt_target/hugging_face/hugging_face_chat_target.py |
Declares token fallback and save prohibition. |
pyrit/prompt_target/http_target/http_target.py |
Disallows saving raw HTTP requests. |
pyrit/prompt_target/hack_a_prompt_target.py |
Declares session and cookie fallbacks. |
pyrit/prompt_target/github_copilot_target.py |
Declares GitHub token fallback. |
pyrit/prompt_target/common/prompt_target.py |
Defines target saveability metadata. |
pyrit/prompt_target/azure_ml_chat_target.py |
Declares credential and endpoint restrictions. |
pyrit/prompt_target/azure_blob_storage_target.py |
Declares token and container restrictions. |
pyrit/prompt_target/a2a_target.py |
Declares destinations requiring credential checks. |
pyrit/models/catalog/target.py |
Adds target origin and ownership fields. |
pyrit/models/catalog/registry_recipe.py |
Defines recipes and restore-report models. |
pyrit/models/catalog/__init__.py |
Exports recipe and origin models lazily. |
pyrit/converter/converter.py |
Adds credential-fallback metadata. |
pyrit/converter/azure_speech_text_to_audio_converter.py |
Declares Speech credential fallback. |
pyrit/converter/azure_speech_audio_to_text_converter.py |
Declares Speech credential fallback. |
pyrit/backend/services/scenario_suite_execution_service.py |
Reports saved-entry launch conflicts. |
pyrit/backend/services/scenario_run_service.py |
Detects caught or wrapped replacement refusals. |
pyrit/backend/services/runtime_lifecycle.py |
Restores recipes before declaring readiness. |
pyrit/backend/routes/targets.py |
Forwards ownership and maps save errors. |
pyrit/backend/routes/scenarios.py |
Documents launch conflicts in API responses. |
pyrit/backend/routes/scenario_suites.py |
Sanitizes storage failure logging and responses. |
pyrit/backend/routes/scenario_presets.py |
Sanitizes storage failure logging and responses. |
pyrit/backend/routes/initializers.py |
Handles unreadable custom-script storage. |
pyrit/backend/README.md |
Documents persistence and ownership behavior. |
pyrit/backend/models/targets.py |
Adds persistence validation and saveability fields. |
pyrit/backend/middleware/auth.py |
Exposes the authenticated caller’s object ID. |
pyrit/backend/mappers/target_mappers.py |
Maps target origin and ownership. |
frontend/src/utils/targetOrigin.ts |
Defines target-origin labels. |
frontend/src/utils/registryName.ts |
Suggests valid, available registry names. |
frontend/src/utils/registryName.test.ts |
Tests name validation and suggestions. |
frontend/src/types/index.ts |
Adds persistence and ownership types. |
frontend/src/test-utils/targetFixtures.ts |
Supports origin and ownership fixtures. |
frontend/src/services/errors.ts |
Recognizes typed save refusals. |
frontend/src/services/errors.test.ts |
Tests save-refusal detection. |
frontend/src/components/Config/TargetTable.tsx |
Displays ownership and filters saved targets. |
frontend/src/components/Config/TargetTable.test.tsx |
Covers origin labels and ownership filtering. |
frontend/src/components/Config/TargetTable.styles.ts |
Styles ownership captions and controls. |
frontend/src/components/Config/TargetOriginBadge.tsx |
Displays target-origin badges. |
frontend/playwright.config.ts |
Isolates seeded backend recipe storage. |
frontend/e2e/registry.spec.ts |
Tests saving targets through the GUI. |
frontend/e2e/fixtures/manual_send_backend.py |
Isolates offline fixture recipe storage. |
frontend/e2e/config.spec.ts |
Tests target saving and ownership displays. |
frontend/e2e/_targets.ts |
Extends target mocks with ownership fields. |
doc/gui/0_gui.md |
Explains saved targets and ownership filtering. |
doc/getting_started/pyrit_conf.md |
Documents restore rules and restricted components. |
.pyrit_conf_example |
Adds a recipe storage configuration example. |
Review effort: Balanced
# Conflicts: # pyrit/backend/services/runtime_lifecycle.py # tests/unit/backend/test_runtime_lifecycle.py
# Conflicts: # pyrit/setup/initializers/tools.py # tests/unit/backend/test_scenario_run_service.py # tests/unit/backend/test_scenario_suite_execution_service.py # tests/unit/registry/test_attack_technique_registry.py # tests/unit/registry/test_instance_registry.py # tests/unit/registry/test_registry_recipe_restore.py
create_named_instance checks the name before it builds, and the technique registry checks names case-insensitively before it registers. Both raised the duplicate-name error without recording the clash, so a launch script that caught either one could still leave a saved entry in place of its own. The name check now records the clash itself, as register already did, and the technique check records it too.
# Conflicts: # tests/unit/registry/test_registry_recipe_restore.py
# Conflicts: # pyrit/backend/mappers/target_mappers.py # pyrit/backend/models/targets.py # pyrit/backend/routes/targets.py # pyrit/backend/services/target_service.py # tests/unit/backend/test_api_routes.py # tests/unit/backend/test_mappers.py # tests/unit/backend/test_runtime_lifecycle.py # tests/unit/backend/test_target_service.py # tests/unit/registry/test_instance_registry.py
# Conflicts: # frontend/src/components/Config/CreateTargetDialog.tsx # pyrit/backend/routes/targets.py # pyrit/backend/services/target_service.py # tests/unit/backend/test_target_service.py # tests/unit/registry/test_registry_recipe_rules.py
# Conflicts: # pyrit/backend/mappers/target_mappers.py # pyrit/backend/routes/targets.py # tests/unit/backend/test_api_routes.py # tests/unit/backend/test_mappers.py # tests/unit/registry/test_registry_recipe_restore.py
# Conflicts: # tests/unit/registry/test_registry_recipe_rules.py
main now declares that TextTarget takes no credentials, with an empty supported_auth_modes. The saved-entry check read that as supporting no mode at all, so it refused saved TextTargets and left the saveability check for the target types with no mode to report. A class that declares no auth modes is now checked as the default api_key mode, which it has no key for.
…d to OpenAIChatTarget
# Conflicts: # pyrit/registry/registry_recipe_rules.py
varunj-msft
requested review from
hannahwestra25 and
Richard Lundeen (richlundeen)
November 8, 2026 02:55
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is one of the changes for saving Registry entries across restarts. It builds on #4028. Until the earlier PRs merge, the diff here also shows their changes.
A saved converter or scorer is rebuilt at every start and shared by everyone using the app, so restore should refuse one that would sign in with this server's own credentials, as it already does for targets (#4025).
AzureContentFilterScorerread this server's key when theirs is empty, or else sign in with its Azure identity, and no value turns that off. They now list that key inserver_fallback_parameters(azure_speech_key,api_key), so the shared saved-entry check refuses them, as it does for targets.AudioTrueFalseScorerandAudioFloatScaleScorertranscribe with this server's Speech settings.LocalRefusalClassifierScorerloads its model from a folder on this server, or downloads it with this server's Hugging Face sign-in. These get anot_saveable_reason, likeWebSocketCopilotTargetandHuggingFaceChatTargetin FIX: Refuse saved targets that would authenticate with a key #4025.server_fallback_parametersis now on theConverterandScorerbases, andnot_saveable_reasononScorer, as onPromptTarget.api_keyin the saved-entry check, ascheck_saveable_classalready assumed. A recipe can no longer pass by naming an auth mode its class doesn't take.pyrit_conf.mdlists the converters and scorers that can't be saved yet.Converters and scorers made without saving, and the ones the startup scripts register, aren't checked.
RobloxPiiScorerandLocalViolenceClassifierScorercan still be saved: their models are fixed public ones and nothing a caller sets.Not covered: saving converters and scorers through the API, which is the next PR. Picking a server credential, or keeping typed keys in a key vault, would let the Speech converters and the Content Safety and audio scorers be saved later.