AI › Module 6 › Lesson 3
Output Handling
Output handling literacy — encoding, sandbox, no raw HTML/JS exec, structured output validation — on `$AI_LAB` app responses.
Visual · t32_output_handling
Output handling = named LLM02 defense rows. $AI_LAB. Original Cyberlium.
Opening
LLM output can carry XSS, SQL, or shell — name output handling controls on YOUR lab app before rendering model text in prod UI.
Output handling literacy names: treat model output as untrusted category, encode for UI context (HTML/JSON/markdown), structured output schema validation, sandbox code execution category, no direct eval of model-generated code, and logging/redaction of sensitive fields. Analyst audits `$AI_LAB` toy app response path — documents three output-handling gaps and fixes (encode, schema validate, sandbox boundary) — without shipping model HTML unsanitized, without running generated shell on host, without paste of prod user PII in test prompts. Cyberlium teaches LLM02 defender rows — NOT how to chain XSS through stranger apps. Refused: XSS PoC against unauthorized sites, auto-exec generated code, prod paste without RoE. Lab row: output handling audit table three findings with fix category.
1. Named output risks
XSS in rendered markdown, SQL in generated queries, shell in code blocks — three literacy anchors.
Model text is untrusted until validated — document encode path on lab UI.
Command guide
Try these commands — Named output risks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP LLM02 Insecure Output Handling — https://owasp.org/www-project-top-10-for-large-language-model-applications/ OpenAI safety — https://platform.openai.com/docs/guides/safety-best-practices CISA AI — https://www.cisa.gov/ai
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
cat > "$AI_LAB/owasp/output-handling-checklist.md" <<'EOF'
# Output Handling Checklist — YOUR app
- [ ] Encode/escape model output before HTML render (XSS prevention)
- [ ] Never exec/eval raw model output as code
- [ ] Validate JSON/schema from model before downstream use
- [ ] Block SSRF patterns in model-suggested URLs
- [ ] Rate limit and size-cap completions
EOFCommand — copy this
grep '\[ \]' "$AI_LAB/owasp/output-handling-checklist.md"
python3 -c "print('Output handling: treat model text as untrusted input')"Primary tools to practice this lesson: grep, python3. Reference sites: OWASP LLM02 Insecure Output Handling (https://owasp.org/www-project-top-10-for-large-language-model-applications/); OpenAI safety (https://platform.openai.com/docs/guides/safety-best-practices); CISA AI (https://www.cisa.gov/ai). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defense rows
Context-aware encoding, JSON schema validation, execution sandbox, deny eval — four controls.
Link LLM02 to Module 6-1 Top 10 mapping row.
3. Refused
No XSS PoC on stranger sites; no auto-exec generated code on host.
Output handling supports secure apps — not offensive chaining.
4. What you ship: output handling audit table
Three findings + fix category each + NEVER auto-exec model code line.
5. What you record before the next lesson
Output handling audit table path.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Render model HTML unsanitized in lab then pivot XSS PoC to stranger site.
Right
Output handling audit from `$AI_LAB` app path. Next: LLM App Lab.
Mission: output handling audit table
1) Name three output risk categories. 2) Three audit findings on lab app. 3) Fix category per row UTC. 4) Write NEVER auto-exec model code line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Structured output schema — literacy stub?”
Knowledge Check
APPLY: Output handling literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Model output is trusted by default.
True or False
Knowledge Check
APPLY: LLM02 defense includes:
Multiple choice