Summary

The Vakil Friend AI legal assistant accepts free-form user text input which is forwarded to the NLP Orchestrator and ultimately to external AI APIs (Groq Llama 3.1, Gemini). The frontend chat interface currently applies no visible client-side validation on the input field — there is no character limit enforcement, no stripping of potentially malicious payloads, and no protection against prompt injection attempts that could manipulate the AI's behaviour or bypass its legal-focus system prompt.

Problem

• The Vakil Friend chat input field has no enforced maximum character limit on the frontend.
• A user can submit an arbitrarily long payload, which when forwarded to Groq or Gemini, could exhaust token quotas for every other user on the platform.
• There is no client-side filtering of obvious prompt injection patterns (e.g., "Ignore all previous instructions and...") before the input is sent to the backend.
• Without sanitization, users may intentionally or accidentally submit inputs containing HTML/script tags, which could affect how the AI's Markdown response is subsequently rendered in the chat UI.
• For a legal AI platform used by potentially vulnerable citizens, ensuring the AI stays on-topic is not merely a UX concern — it is a product integrity concern.

Impact

• Malicious or curious users can manipulate the AI assistant's persona and responses through prompt injection.
• Extremely long inputs can cause increased latency and token cost for every user sharing the platform's AI quota.
• Unfiltered input rendered in the chat UI after AI processing may create XSS risk if the AI echoes back malicious content.

Proposed Solution

1. Character limit enforcement: Cap the Vakil Friend input field at 2,000 characters. Show a live character counter (e.g., "1,847 / 2,000") that turns red as the limit approaches, and disable the send button when exceeded.

2. Client-side prompt injection heuristics: Before submitting, warn (but do not block) if the input contains patterns commonly used in prompt injection:

const injectionPatterns = [
  /ignore\s+(all\s+)?(previous|prior)\s+instructions/i,
  /disregard\s+your\s+(system|initial)\s+prompt/i,
  /you\s+are\s+now\s+a/i,
  /act\s+as\s+if\s+you\s+are/i,
];

Show a non-blocking advisory: "Your message contains phrasing that may not produce useful legal results. Please describe your legal question directly."

3. HTML entity encoding: Encode all user input before displaying it in the chat bubble to prevent any XSS risk from user-supplied content.

4. Backend reinforcement (secondary): Add a server-side input length check in the FastAPI NLP orchestrator's POST /research/deep handler, returning a 400 Bad Request if len(query) > 3000, as a fallback if the frontend check is bypassed.

I am happy to implement all of the above. Could you please assign this issue to me?

Labels: security, enhancement, UX, help wanted, GSSoC 2026