[Pouyanpi]

Description

action: omit could allow detected injections when removal failed or was incomplete. Preserve detection, block incomplete omission and remaining matches, and return refusals in both Colang flows. Add regression tests and document the behavior.

Related Issue(s)

NGR-1071

Verification

• Before/after comparison script and results: 695 generated inputs × 5 rule configurations × 2 modes = 6,950 comparisons on each of YARA 4.5.1 and 4.5.4. Uses real YARA rules to compare pre-fix and fixed actions, checks unchanged reject behavior, and rejects unexplained omission changes. No model calls. Both runs passed with no unexplained differences: reject results were identical, and omit changes were limited to expected blocks for truncated or still-matching output.

Local omit-path timings, before the PR → corrected action, in milliseconds per call:

YARA	1,000 bytes	10,000 bytes	100,000 bytes
4.5.1	0.419 → 0.437	0.498 → 0.512	0.624 → 0.789
4.5.4	0.418 → 0.395	0.433 → 0.458	0.572 → 0.757

macOS arm64, Python 3.12.7; all four shipped rules; ASCII padding plus one removable XSS match. Median of five 100-call samples after ten warmups, alternating implementation order. Includes rule compilation on each action call; logging disabled, no provider calls. These local measurements include timing noise and are not performance thresholds.

Checklist

• I've read the CONTRIBUTING guidelines.
• This PR links to a triaged issue assigned to me.
• My PR title follows the project commit convention.
• I've updated the documentation if applicable.
• I've added tests if applicable.
• I've noted any verification beyond CI and any checks I couldn't run.
• I did not update generated changelog files manually.
• I addressed all CodeRabbit, Greptile, and other review comments, or replied with why no change is needed.
• @mentions of the person or team responsible for reviewing proposed changes.

Summary by CodeRabbit

• Bug Fixes
  • Injection detection now blocks responses when detected content cannot be fully removed or the remaining text still triggers a detection rule.
  • Responses are also blocked when omission leaves the original text unchanged, including when detection details are incomplete or cannot be processed.
• Documentation
  • Clarified when the omit action blocks a response.

[github-actions]

Staged Fern docs preview: https://nvidia-preview-pr-2558.docs.buildwithfern.com/nemo/guardrails

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the previous encoded-match bypass is fixed.

Summary

Injection detection now blocks output when omit cannot fully remove detected content or the changed text still matches a rule.

• Injection detection blocks output when omission cannot remove a match completely.

_{Reviews (2) · Last reviewed commit: "fix(injection): block XOR-decoded matche..." · Reviewed by Greptile}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Injection detection now treats incomplete omission as a detection, rechecks modified text against configured rules, and blocks omit-mode output when the text remains unchanged. The Colang rejection paths no longer depend on the configured action being reject.

Changes: Injection omission and blocking

Layer / File(s)	Summary
Omission detection and validation nemoguardrails/library/injection_detection/actions.py, tests/test_injection_detection.py, docs/configure-rails/guardrail-catalog/agentic-security.mdx	Omission now reports detected matches when it cannot remove them and preserves the original text in those cases. Modified text is checked against the rules again. Tests cover decode errors, incomplete or overlapping matches, custom rules, and the documented omit-mode behavior.
Blocked outcomes and rejection flow nemoguardrails/library/injection_detection/actions.py, nemoguardrails/library/injection_detection/flows.co, nemoguardrails/library/injection_detection/flows.v1.co, tests/test_injection_detection.py, tests/test_runtime_flow_gate_equivalence.py, tests/guardrails/test_cross_engine_local_rails.py	Detected injections with unchanged omit-mode output now produce a blocked outcome. The Colang flows proceed to the rejection message when rail exceptions are disabled, regardless of the configured action. Tests cover outcome equivalence, Colang behavior, and output-rail XSS handling.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant YARA
  participant injection_detection
  participant omit_injection
  participant detection_outcome
  participant ColangFlow
  YARA->>injection_detection: return match data
  injection_detection->>omit_injection: attempt to omit detected spans
  omit_injection-->>injection_detection: return text and detection status
  injection_detection->>YARA: recheck modified text
  YARA-->>injection_detection: return remaining matches
  injection_detection->>detection_outcome: provide text and detection metadata
  detection_outcome-->>ColangFlow: return blocked outcome
  ColangFlow-->>ColangFlow: send rejection message when rail exceptions are disabled

Loading

Possibly related issues

• NVIDIA-NeMo/Guardrails issue 2045 — The PR changes the omit-mode decode-error path so a detected match that cannot be decoded preserves the original text and remains a detection.

Possibly related PRs

• NVIDIA-NeMo/Guardrails#2257: Both PRs change the injection-detection rail’s handling of malformed or incompletely removable YARA matches.

Suggested reviewers: erickgalinkin, tgasser-nv

Merge Risk: Minimal · up to 8477f

The reported omit-mode test failure does not occur. No actionable merge-blocking issue remains after normal checks.

Pre-merge checks: 4 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Results For Major Changes		The PR is a major security behavior change: it updates injection omission, both Colang flows, and adds 227 lines with regression coverage. The description documents functional verification (6,950 comp…	Add before-and-after performance measurements for the injection-detection omit path. State the YARA versions, rule configurations, input sizes, execution environment, and measurement method. Keep the existing functional test results.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: blocking output when injection omission is incomplete. It is specific and directly related to the implementation and tests.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 6 functions across 4 files. (3 skipped: 3 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Full details: Test Results For Major Changes

Explanation

The PR is a major security behavior change: it updates injection omission, both Colang flows, and adds 227 lines with regression coverage. The description documents functional verification (6,950 comparisons per YARA version), but the code adds a second rules.match scan after omission. This can affect performance. The description has no before-and-after performance numbers or timing results for that path.

Resolution

Add before-and-after performance measurements for the injection-detection omit path. State the YARA versions, rule configurations, input sizes, execution environment, and measurement method. Keep the existing functional test results.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: NVIDIA-NeMo/Guardrails
• Branch: pouyanpi/bug-injection-detection-1
• File: .coderabbit.yaml
• Commit: 8477f4e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: d4d8898d-ea96-4838-88b4-0ca2180dd4d0

Commits

Reviewing files that changed from the base of the PR and between 069dfdf and 8477f4e.

Files selected for processing: 7

• docs/configure-rails/guardrail-catalog/agentic-security.mdx
• nemoguardrails/library/injection_detection/actions.py
• nemoguardrails/library/injection_detection/flows.co
• nemoguardrails/library/injection_detection/flows.v1.co
• tests/guardrails/test_cross_engine_local_rails.py
• tests/test_injection_detection.py
• tests/test_runtime_flow_gate_equivalence.py

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.