Summary

The replaceMarkers function in src/security/external-content.ts performs pattern matching on the folded string but applies replacements to the original content. This allows fullwidth character markers to bypass sanitization.

Impact

Severity: High (10/10)
Type: Security - Potential prompt injection

Suggested Fix

Perform all slicing and replacement operations on the folded string instead of the original content to ensure full-width character markers are correctly sanitized.

Source

Identified by Qodo AI code review.

Files Affected

• src/security/external-content.ts (lines 108-148)