feat: add code injection detection to guardrails library

[erickgalinkin]

Description

Add (sql, code, template, xss) injection detection support

Checklist

• I've read the CONTRIBUTING guidelines.
• I've updated the documentation if applicable.
• I've added tests if applicable.

[github-actions]

Documentation preview

https://nvidia.github.io/NeMo-Guardrails/review/pr-1091

[Pouyanpi]

@erickgalinkin currently we don't have yara as extra dependency. And as the tests depend on it they need to get included in dev group too. If you don't mind, I'll push the updated pyrpoject.toml and poetry.lock

[erickgalinkin]

@erickgalinkin currently we don't have yara as extra dependency. And as the tests depend on it they need to get included in dev group too. If you don't mind, I'll push the updated pyrpoject.toml and poetry.lock

Thanks @Pouyanpi !

[Pouyanpi]

@erickgalinkin

Python 3.9 complains about [structural pattern matching]( job details: https://github.com/NVIDIA/NeMo-Guardrails/blob/feature/code-injection-detection/nemoguardrails/library/injection_detection/actions.py#L254-L263) (https://github.com/NVIDIA/NeMo-Guardrails/actions/runs/14243111294/job/39917918776?pr=1091#step:15:33)

I like it but we should wait until October 2025

[erickgalinkin]

I saw that -- will adjust to support 3.9 and push a fix shortly, thanks!

[Pouyanpi]

@erickgalinkin I'm enjoying every bits of this PR and am learning, it is great 🚀 Thank you!

If you don't mind I'm going to add more tests while I'm learning about this new feature. If some changes were required I'll mention you in the comments.

[Pouyanpi]

@erickgalinkin , am I doing something wrong?

from nemoguardrails import RailsConfig, LLMRails

messages = [
    {"role": "user", "content": "what can you do"},
    {
        "role": "assistant",
        "content": "This is a SELECT * FROM users; -- malicious comment in the middle of text",
    },
]
config = RailsConfig.from_content(
    yaml_content="""
            models: []
            rails:
              config:
                injection_detection:
                  injections:
                    - sqli
                  action:
                    omit
              output:
                flows:
                  - mitigate injection

            """
)
rails = LLMRails(config, verbose=False)
response = rails.generate(
    messages=messages,
    options={
        "rails": ["output"],
        "log": {
            "activated_rails": True,
            "llm_calls": False,
            "internal_events": False,
            "colang_history": False,
        },
    },
)

I get:

  File "nemoguardrails/library/injection_detection/actions.py", line 166, in omit_injection
    for instance in match_string:
TypeError: 'yara.StringMatch' object is not iterable

line 166:

[Pouyanpi]

  File "nemoguardrails/library/injection_detection/actions.py", line 166, in omit_injection
    for instance in match_string:
TypeError: 'yara.StringMatch' object is not iterable

line 166:

resolved with changes in af80ad7, please let me know if I've broken something.

[tgasser-nv]

Looks good! Left some comments on organizing the strings into Enums and returning a more helpful response with debugging information when the yara rules are triggered.

I'm also curious if there's a dataset out there with examples of the injection types we want to detect, and safe prompts which we shouldn't flag. Then we can evaluate the coverage we get from the yara rules>

[Pouyanpi]

Thank you @erickgalinkin!

FYI, I just made following changes:

• removed the merge commits (we prefer rebase)
• applied pre-commits
• update poetry lock to use Poetry 1.8.2 (we don't support >=0.2.0 yet)

for the next PRs just make sure that you have pre-commits installed 👍🏻

[Pouyanpi]

LGTM!

[erickgalinkin]

Looks like this is good to merge if you're ok with it @tgasser-nv. Any outstanding questions on your side?

[tgasser-nv]

LGTM, thanks for making the updates!