Display AI answers on a web page and turn some text into links.
Generated HTML or URLs must not execute.
Choose two controls.
Escape output, limit URL schemes, domains, and elements, validate structure, and separate display from executable operations.
Detailed explanation
XSS and unsafe links are reduced.
XSS and unsafe links are reduced.
Generated text does not become code automatically.
Generated text does not become code automatically.
Output can contain attacker-controlled text.
Output can contain attacker-controlled text.
The attack surface expands.
The attack surface expands.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式AIF-C01 Domain 2.3・5.1の出力検証、Web安全、Guardrailsを確認する。Expected result
生成結果をHTML・URL・コードへ無加工で渡さない境界を説明できる。Key points
- Escaping
- Schema
- XSS
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.