t
115 lines
3.9 KiB
Go
115 lines
3.9 KiB
Go
package tooling
|
|
|
|
import (
|
|
"fmt"
|
|
"regexp"
|
|
"strings"
|
|
"unicode"
|
|
)
|
|
|
|
const maxCustomerReplyRunes = 8000
|
|
|
|
const restrictedNetworkPolicyFallback = "当前网络状态请以实际使用情况为准。如无法联网，请使用“智能检测”或联系人工客服。"
|
|
|
|
const restrictedICCIDFallback = "ICCID 属于系统内部标识，无法提供。"
|
|
|
|
var restrictedNetworkPolicyPattern = regexp.MustCompile(`(?i)限速|降速|速率限制|带宽限制|speed[ _-]?limit|throttl|traffic[ _-]?shap|(?:^|[^a-z0-9])\d+(?:\.\d+)?\s*(?:k|m|g)?bps(?:[^a-z0-9]|$)`)
|
|
|
|
var restrictedICCIDLabelPattern = regexp.MustCompile(`(?i)iccid|集成电路卡识别码|sim\s*卡序列号`)
|
|
|
|
// ICCIDs normally start with 89 and contain 18 to 22 digits. Allow common
|
|
// separators so Markdown emphasis or spaced formatting cannot bypass the
|
|
// customer-visible output boundary.
|
|
var restrictedICCIDNumberPattern = regexp.MustCompile(`\b89(?:[ \t._*-]*\d){16,20}\b`)
|
|
|
|
// NormalizeCustomerReply applies the final plain-text boundary before an AI
|
|
// response enters a customer conversation. It rejects likely credential
|
|
// assignments instead of masking them, because a masked secret is not useful
|
|
// customer-facing content.
|
|
func NormalizeCustomerReply(value string) (string, error) {
|
|
value = strings.TrimSpace(value)
|
|
if value == "" {
|
|
return "", fmt.Errorf("ai reply is empty")
|
|
}
|
|
if secretAssignmentPattern.MatchString(value) {
|
|
return "", fmt.Errorf("ai reply contains sensitive credential data")
|
|
}
|
|
var builder strings.Builder
|
|
for _, r := range value {
|
|
if (unicode.IsControl(r) && r != '\n' && r != '\t') || unicode.In(r, unicode.Cf) {
|
|
continue
|
|
}
|
|
builder.WriteRune(r)
|
|
}
|
|
value = strings.TrimSpace(builder.String())
|
|
for strings.Contains(value, "\n\n\n") {
|
|
value = strings.ReplaceAll(value, "\n\n\n", "\n\n")
|
|
}
|
|
value = redactRestrictedNetworkPolicy(value)
|
|
value = RedactRestrictedICCID(value)
|
|
if value == "" {
|
|
return "", fmt.Errorf("ai reply is empty")
|
|
}
|
|
if len([]rune(value)) > maxCustomerReplyRunes {
|
|
return "", fmt.Errorf("ai reply exceeds maximum length")
|
|
}
|
|
return value, nil
|
|
}
|
|
|
|
// ContainsRestrictedICCID reports whether text contains an ICCID label or a
|
|
// value shaped like an ICCID. Callers use it to keep internal identity values
|
|
// out of prompts and automatic customer messages as well as AI replies.
|
|
func ContainsRestrictedICCID(value string) bool {
|
|
return restrictedICCIDLabelPattern.MatchString(value) || restrictedICCIDNumberPattern.MatchString(value)
|
|
}
|
|
|
|
// RedactRestrictedICCID removes labelled ICCID lines and hides bare ICCID
|
|
// values. A fixed explanation is appended whenever anything was removed.
|
|
func RedactRestrictedICCID(value string) string {
|
|
if !ContainsRestrictedICCID(value) {
|
|
return value
|
|
}
|
|
lines := strings.Split(value, "\n")
|
|
safe := make([]string, 0, len(lines)+1)
|
|
redacted := false
|
|
for _, line := range lines {
|
|
if restrictedICCIDLabelPattern.MatchString(line) {
|
|
redacted = true
|
|
continue
|
|
}
|
|
cleaned := restrictedICCIDNumberPattern.ReplaceAllString(line, "[内部标识已隐藏]")
|
|
if cleaned != line {
|
|
redacted = true
|
|
}
|
|
safe = append(safe, cleaned)
|
|
}
|
|
if redacted {
|
|
safe = append(safe, restrictedICCIDFallback)
|
|
}
|
|
return strings.TrimSpace(strings.Join(safe, "\n"))
|
|
}
|
|
|
|
// redactRestrictedNetworkPolicy is a final customer-visible safety boundary.
|
|
// The model may still ignore its system prompt, so any line that confirms,
|
|
// denies, or quantifies an internal network speed policy is removed before the
|
|
// message is persisted. Other useful lines are preserved.
|
|
func redactRestrictedNetworkPolicy(value string) string {
|
|
if !restrictedNetworkPolicyPattern.MatchString(value) {
|
|
return value
|
|
}
|
|
lines := strings.Split(value, "\n")
|
|
safe := make([]string, 0, len(lines)+1)
|
|
redacted := false
|
|
for _, line := range lines {
|
|
if restrictedNetworkPolicyPattern.MatchString(line) {
|
|
redacted = true
|
|
continue
|
|
}
|
|
safe = append(safe, line)
|
|
}
|
|
if redacted {
|
|
safe = append(safe, restrictedNetworkPolicyFallback)
|
|
}
|
|
return strings.TrimSpace(strings.Join(safe, "\n"))
|
|
}
|