Interview Q29: Why should model output be safely rendered?
Generated text may include unsafe HTML, links, or content that could create XSS or phishing risks. Use textContent for plain text and sanitize permitted rich content.
Interview structure: define the concept, explain the design trade-off, and give one production example.
Note
Interview approach: explain the concept, show the control boundary, and discuss the failure mode.
Minimal illustration
// Example: validate a boundary before doing work.
function requireNonEmptyString(value) {
if (typeof value !== "string" || value.trim() === "") {
throw new Error("Expected a non-empty string");
}
return value;
}💡 The snippet demonstrates a general boundary-validation principle. Adapt the example to the concept and explain how the application enforces the rule at runtime.
Key Takeaways
- State the concept clearly.
- Mention one limitation or failure mode.
- Connect it to a production decision.
Knowledge Check
What is a safe default for rendering plain model text?