defangUntrustedDelimiters
defangUntrustedDelimiters(
text):string
Defined in: packages/core/src/utils/untrustedText.ts:85
Neutralize every structural delimiter this codebase emits, inside UNTRUSTED text.
The text is fully attacker-influenceable, so it may forge:
- any fence’s tokens (
[BEGIN|END MCP SERVER-PROVIDED CONTEXT],[BEGIN|END QUOTED COMMAND TEXT],[BEGIN|END CLIENT-PROVIDED ATTACHMENT]) — the bracket run is collapsed so they can no longer be read as the real delimiter, while staying legible to a reader who wants to see what was attempted; and - a per-server label line
--- Server: …(EXT-32) — the leading---run is broken so it cannot masquerade as one of ours.
After this, the ONLY real delimiters in a composed block are the ones the caller emits. Names we put in our OWN labels come from trusted config keys and are not sanitized — only the untrusted CONTENT is.
Whitespace-tolerant (\s+, optional bracket padding, -{3,}) so trivial spacing variants cannot
slip a delimiter through, and case-insensitive so neither can a lowercase one.
Parameters
Section titled “Parameters”string
Returns
Section titled “Returns”string