Escape reserved tokens in untrusted chat inputs

#19
by mvp468 - opened

Summary

  • add a small Jinja macro that escapes Kimi special-token delimiters in untrusted user and tool text
  • sanitize dynamic role names and tool-call IDs before inserting them into the serialized prompt
  • preserve existing rendering for normal inputs and trusted system/assistant content

Security impact

Without escaping, input containing sequences such as <|im_end|><|im_system|> can be tokenized as real control tokens and escape the caller's intended role boundary.

Validation

  • confirmed normal user-message rendering is unchanged
  • confirmed reserved delimiters in string content, structured text content, role names, and tool-call IDs render as inert text
  • only chat_template.jinja is changed
Ready to merge
This branch is ready to get merged automatically.

Sign up or log in to comment