fix: cover bare llm.prompts and llm.prompt_template in content controls - #54
Merged
Merged
Conversation
The prefix entries (llm.prompts., llm.prompt_template.) only match flattened indexed keys; an instrumentation that sets the bare attribute carried prompts past capture_content=False and mask. Both bare keys join CONTENT_ATTRIBUTES, and a new invariant test asserts every content prefix's bare key is covered, so the class of gap cannot recur.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the privacy gap from RIUS-375:
CONTENT_ATTRIBUTE_PREFIXEScovers the flattened forms (llm.prompts.0...), but neither bare key was inCONTENT_ATTRIBUTES, so an instrumentation settingllm.promptsorllm.prompt_templateas a single attribute sailed pastcapture_content=Falseandmask— a privacy control failing open.Changes
CONTENT_ATTRIBUTES(with a comment explaining why prefix coverage never covers its own bare key).test_capture_content_false_covers_unflattened_prompt_keys: the behavioral regression test through the real export path.test_every_content_prefix_has_its_bare_key_covered: the invariant whose silent violation caused this — every entry inCONTENT_ATTRIBUTE_PREFIXESmust have its bare key inCONTENT_ATTRIBUTES. Kills the bug class, not just the instance.Severity check (per the ticket)
Verified against the pinned bundled instrumentation rather than assuming:
openinference-instrumentation-openai0.1.52 flattens intollm.prompts.{i}.prompt.text, which the prefix already covered, so no confirmed leak from the bundled OpenAI path at current pins. Howeveropeninference-semantic-conventionsdefines bareLLM_PROMPTS = \"llm.prompts\"as a first-class key, the langchain/llama-index extras were not auditable in this environment, and both OpenInference and OpenLLMetry have changed flattening behavior across versions — so the fix is warranted defense-in-depth regardless.This matches the TypeScript SDK's behavior (already fixed there under RIUS-197), removing the divergence.
Suite: 199 passed; ruff, format, mypy strict clean.
RIUS-375