security(hooks): Wrap hook-injected context in distinct XML tags (#17237)

Co-authored-by: Yuna Seol <yunaseol@google.com>

packages/core/src/hooks/types.test.ts

@@ -177,13 +177,24 @@ describe('Hook Output Classes', () => {
       expect(output.applyToolConfigModifications(target)).toBe(target);
     });
 
-    it('getAdditionalContext should return additionalContext if present', () => {
+    it('getAdditionalContext should return additional context if present', () => {
       const output = new DefaultHookOutput({
         hookSpecificOutput: { additionalContext: 'some context' },
       });
       expect(output.getAdditionalContext()).toBe('some context');
     });
 
+    it('getAdditionalContext should sanitize context by escaping <', () => {
+      const output = new DefaultHookOutput({
+        hookSpecificOutput: {
+          additionalContext: 'context with <tag> and </hook_context>',
+        },
+      });
+      expect(output.getAdditionalContext()).toBe(
+        'context with &lt;tag&gt; and &lt;/hook_context&gt;',
+      );
+    });
+
     it('getAdditionalContext should return undefined if additionalContext is not present', () => {
       const output = new DefaultHookOutput({
         hookSpecificOutput: { other: 'value' },

packages/core/src/hooks/types.ts

@@ -213,7 +213,7 @@ export class DefaultHookOutput implements HookOutput {
   }
 
   /**
-   * Get additional context for adding to responses
+   * Get sanitized additional context for adding to responses.
    */
   getAdditionalContext(): string | undefined {
     if (
@@ -221,7 +221,12 @@ export class DefaultHookOutput implements HookOutput {
       'additionalContext' in this.hookSpecificOutput
     ) {
       const context = this.hookSpecificOutput['additionalContext'];
-      return typeof context === 'string' ? context : undefined;
+      if (typeof context !== 'string') {
+        return undefined;
+      }
+
+      // Sanitize by escaping < and > to prevent tag injection
+      return context.replace(/</g, '&lt;').replace(/>/g, '&gt;');
     }
     return undefined;
   }