fix(security): sanitize report output, prevent prompt injection, remove dead code

- Sanitize markdown report content to prevent stored XSS
- Sanitize AI prompt inputs to prevent prompt injection
- Remove unused ScanOrchestrator instantiation in commands.py
- Remove unused _agent_instances dict in scheduler.py
- Fix asyncio.run() to handle already-running event loop

Author: bot

bugfinder/ai/prompts.py

@@ -1,12 +1,19 @@
 from __future__ import annotations
 
+import re
+
 """
 Prompt templates for AI interactions.
 
 Each prompt is a function that takes context and returns a (system, user) tuple.
 """
 
 
+def _sanitize_prompt(text: str, max_length: int = 1000) -> str:
+    cleaned = re.sub(r"[<>{}\\;]", "", text)
+    return cleaned[:max_length]
+
+
 SYSTEM_PLANNER = """You are BugFinder's AI security assessment planner.
 Your role is to analyze the target, review current findings, and decide the next best step.
 Only recommend steps that are legal and within scope.
@@ -30,19 +37,19 @@
 
 def planner_prompt(target_type: str, target: str, graph_summary: str) -> tuple[str, str]:
     system = SYSTEM_PLANNER
-    user = f"""Target Type: {target_type}
-Target: {target}
-Current Knowledge Graph: {graph_summary}
+    user = f"""Target Type: {_sanitize_prompt(target_type)}
+Target: {_sanitize_prompt(target)}
+Current Knowledge Graph: {_sanitize_prompt(graph_summary)}
 
 What should I test next? Respond in JSON format."""
     return system, user
 
 
 def explainer_prompt(finding_title: str, description: str, evidence: str) -> tuple[str, str]:
     system = SYSTEM_EXPLAINER
-    user = f"""Finding: {finding_title}
-Description: {description}
-Evidence: {evidence}
+    user = f"""Finding: {_sanitize_prompt(finding_title)}
+Description: {_sanitize_prompt(description)}
+Evidence: {_sanitize_prompt(evidence)}
 
 Explain this finding in simple terms. Include:
 1. What is this vulnerability?
@@ -55,9 +62,9 @@ def explainer_prompt(finding_title: str, description: str, evidence: str) -> tup
 
 def report_prompt(target: str, findings_summary: str, graph_summary: str) -> tuple[str, str]:
     system = SYSTEM_REPORT
-    user = f"""Target: {target}
-Findings: {findings_summary}
-Asset Graph: {graph_summary}
+    user = f"""Target: {_sanitize_prompt(target)}
+Findings: {_sanitize_prompt(findings_summary)}
+Asset Graph: {_sanitize_prompt(graph_summary)}
 
 Generate a professional security assessment report."""
     return system, user

bugfinder/cli/commands.py

@@ -152,7 +152,11 @@ def _run_scan(
     output: str | None = None,
     report_format: str = "markdown",
 ) -> None:
-    asyncio.run(_async_scan(target, profile, expert, output, report_format))
+    try:
+        loop = asyncio.get_running_loop()
+        loop.create_task(_async_scan(target, profile, expert, output, report_format))
+    except RuntimeError:
+        asyncio.run(_async_scan(target, profile, expert, output, report_format))
 
 
 async def _async_scan(
@@ -164,7 +168,6 @@ async def _async_scan(
 ) -> None:
     from bugfinder.database.repository import Repository
     from bugfinder.database.session import async_session_factory
-    from bugfinder.engine.scheduler import ScanOrchestrator
     from bugfinder.knowledge_graph.graph import KnowledgeGraph
     from bugfinder.reporting.markdown import generate_markdown_report
 
@@ -193,8 +196,6 @@ async def _async_scan(
     except Exception:
         pass
 
-    ScanOrchestrator(kg, ai_client, repo)
-
     ttype = target.type.value
 
     rprint(f"\n[bold]Scan Plan[/bold] ({target.type.value})")

bugfinder/engine/scheduler.py

@@ -53,7 +53,6 @@ def __init__(
         self.repo = repository
         self.progress = ScanProgress(target="", target_type="")
         self._start_time: float = 0.0
-        self._agent_instances: dict[str, Any] = {}
 
     def log(self, message: str) -> None:
         self.progress.log.append(message)

bugfinder/reporting/markdown.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from datetime import UTC, datetime
 from typing import Any
 
@@ -15,6 +16,11 @@
 }
 
 
+def _sanitize_md(text: str) -> str:
+    text = re.sub(r"[`*_{}[\]()#+\-.!|~]", "", text)
+    return text[:500]
+
+
 def generate_markdown_report(
     target: str,
     target_type: str,
@@ -89,7 +95,7 @@ def generate_markdown_report(
     for i, f in enumerate(sorted_findings, 1):
         sev = f.get("severity", "info")
         icon = SEVERITY_ICONS.get(sev, "")
-        title = f.get("title", "Untitled Finding")
+        title = _sanitize_md(f.get("title", "Untitled Finding"))
         lines.append(f"### {i}. {icon} {title}")
         lines.append("")
         lines.append(f"- **Severity**: {sev.upper()}")
@@ -105,7 +111,7 @@ def generate_markdown_report(
 
         lines.append("")
 
-        desc = f.get("description", "")
+        desc = _sanitize_md(f.get("description", ""))
         if desc:
             lines.append(f"**Description**: {desc}")
             lines.append("")