fix(security): sanitize page title to prevent prompt injection in Web Surfer

[xr843]

Summary

Fixes #7457 — Web Surfer agent vulnerable to indirect prompt injection via page title.

• Add _sanitize_page_metadata() function that strips control characters, collapses whitespace, removes markdown link syntax, and truncates values to a safe length (200 chars for titles, 500 for URLs)
• Apply sanitization at all 4 injection points in _multimodal_web_surfer.py: tool prompt construction (MM and text), state description output, and page summarization
• Replace markdown link syntax [{title}]({url}) in prompt templates with XML-style delimiters <page_title>/<page_url> to clearly separate untrusted web content from system instructions
• Add comprehensive test suite covering normal titles, control character injection, null bytes, long payload truncation, markdown syntax stripping, social engineering attacks, and instruction override attempts

Why this approach

This is a defense-in-depth strategy. Prompt injection cannot be fully solved at the application layer alone, but these mitigations significantly raise the bar:

1. Control character stripping — prevents multi-line injection that could mimic system/user message boundaries
2. Length truncation — limits the attacker's prompt budget for crafting convincing injections
3. Markdown syntax removal — prevents titles from creating clickable links that could confuse the LLM
4. XML delimiters — helps the LLM distinguish between its instructions and external webpage metadata

Affected files

• python/packages/autogen-ext/src/autogen_ext/agents/web_surfer/_prompts.py — sanitization function + updated templates
• python/packages/autogen-ext/src/autogen_ext/agents/web_surfer/_multimodal_web_surfer.py — apply sanitization at all injection points
• python/packages/autogen-ext/tests/test_web_surfer_sanitization.py — new test suite

Test plan

• pytest python/packages/autogen-ext/tests/test_web_surfer_sanitization.py — 14 unit tests covering sanitization logic and prompt integration
• Verify existing web surfer tests still pass
• Manual test: visit a page with a malicious <title> tag and confirm the sanitized title appears in agent prompts

🤖 Generated with Claude Code

[xr843]

@microsoft-github-policy-service agree

[xr843]

Hi team, just a gentle ping on this PR. CLA has been signed and all CI checks are passing. Happy to make any adjustments if needed. Thanks for your time!

[xr843]

Closing this as part of a cleanup — I want to focus my contributions on fewer projects rather than spreading thin. The fix is still valid if maintainers want to pick it up. Happy to reopen if there's interest!