Improve Jinja Injection Detection

[erickgalinkin]

Change JinjaTemplateDetector to JinjaTemplateInjectionDetector. Improve fidelity of JinjaTemplateInjectionDetector. Add test for Jinja template that does not contain payload.

Verification

(garak) ➜  garak git:(template-injection-enhancement) ✗ garak --target_type openai.OpenAIReasoningGenerator --target_name gpt-5-nano -p exploitation.JinjaTemplatePythonInjection -g 1
garak LLM vulnerability scanner v0.14.1.pre1 ( https://github.com/NVIDIA/garak ) at 2026-02-06T10:34:27.771199
📜 logging to /Users/egalinkin/.local/share/garak/garak.log
🦜 loading generator: OpenAI: gpt-5-nano
📜 reporting to /Users/egalinkin/.local/share/garak/garak_runs/garak.69d0ed6a-eabf-4878-831b-ba8ac4128da9.report.jsonl
🕵️  queue of probes: exploitation.JinjaTemplatePythonInjection
exploitation.JinjaTemplatePythonInjection                exploitation.JinjaTemplateInjectionDetector: FAIL  ok on    5/   9   (attack success rate:  44.44%)
exploitation.JinjaTemplatePythonInjection                           exploitation.PythonCodeExecution: FAIL  ok on    5/   9   (attack success rate:  44.44%)
📜 report closed :) /Users/egalinkin/.local/share/garak/garak_runs/garak.69d0ed6a-eabf-4878-831b-ba8ac4128da9.report.jsonl
📜 report html summary being written to /Users/egalinkin/.local/share/garak/garak_runs/garak.69d0ed6a-eabf-4878-831b-ba8ac4128da9.report.html
✔️  garak run complete in 107.54s

(garak) ➜  garak git:(template-injection-enhancement) ✗ pytest tests/detectors/test_detectors_exploitation.py
==== test session starts ====
platform darwin -- Python 3.11.12, pytest-9.0.2, pluggy-1.6.0
rootdir: /Users/egalinkin/dev/garak
configfile: pyproject.toml
plugins: respx-0.22.0, anyio-4.9.0, langsmith-0.6.9, mock-3.14.1, pytest_httpserver-1.1.3, requests-mock-1.12.1, cov-7.0.0
collected 8 items

tests/detectors/test_detectors_exploitation.py ........                                                                                                                                                                                                                                                                                                                                                                              [100%]

==== 8 passed in 4.11s ====

[jmartin-tech]

I would think there is value is storing which payloads were found.

[erickgalinkin]

I suppose we'd stick that in notes?

[jmartin-tech]

I think so, currently a number of probes inject triggers that detectors use as context for the selection so I would suspect a complimenting entry would be valuable in general. matches or something might be a reasonable name.

[jmartin-tech]

This also leads to the idea that detector results may come with evidence and maybe should get a more complex return type. Not something in scope here but worth entertaining thoughts about.

[leondz]

pkghallu detection uses notes[f"hallucinated_{self.language_name}_packages"]

+1 for an evidence field for individual detections, in general. Request tracked in #1624

[leondz]

lgtm

[leondz]

pkghallu detection uses notes[f"hallucinated_{self.language_name}_packages"]

+1 for an evidence field for individual detections, in general. Request tracked in #1624

[leondz]

what exactly is the nature of this game? troubling

[jmartin-tech]

The renamed detector here may be appropriate to have a fixer to support detection of outdated use in detector_spec or for a config that set the skip parameter.