Apply this guide to your situation
This answer covers “[AI-013] Generated output introduces unsafe HTML or links”. Read it with the summary and confirm that the symptom and service match what you are experiencing. Available options can vary by plan and account setup.
- Before changing anything, note what you expected, what happened and roughly when. Check whether the issue affects one page or the whole service.
- Save the full error message and note recent changes. Hide passwords, access codes, personal data and keys before sharing screenshots or logs.
- If a step requires administrator access, restarting services or editing server files, stop if you do not administer that server. Send support the service name, error and checks you have already made.
L3 technical diagnosis
User symptoms
A response renders active tags, runs script or points to a misleading URL.
Observed code or message
CSP violation / XSS in generated-content previewLikely root cause
Trusting model output as HTML, disabling escaping or allowing `javascript:`/data URLs enables stored or reflected XSS.
Likely-cause and resolution matrix
Follow a branch only when evidence supports it. A symptom may have more than one cause; do not change layers by guesswork.
01Professional English translation pending.
Why it can happen: Professional English translation pending.
Professional English translation pending.Step-by-step resolution:
Professional English translation pending.
02Professional English translation pending.
Why it can happen: Professional English translation pending.
Professional English translation pending.Step-by-step resolution:
Professional English translation pending.
03Professional English translation pending.
Why it can happen: Professional English translation pending.
Professional English translation pending.Step-by-step resolution:
Professional English translation pending.
04Professional English translation pending.
Why it can happen: Professional English translation pending.
Professional English translation pending.Step-by-step resolution:
Professional English translation pending.
05Professional English translation pending.
Why it can happen: Professional English translation pending.
Professional English translation pending.Step-by-step resolution:
Professional English translation pending.
Prerequisites
- Authorised access to the involved runtime, provider or automation.
- A test environment and synthetic data; never use customer prompts for diagnostics.
- A technical owner who can approve network, secret, GPU or resource changes.
Important warnings
- Do not expose local inference endpoints or webhooks without appropriate authentication, TLS and limits. Never put API keys, private prompts or personal data in commands, screenshots or logs.
- Commands are diagnostic references. Production changes, Docker/firewall rules and credential rotation require service-owner authorisation.
Step-by-step walkthrough
1. Confirm the symptom and scope
# Manual staging check: attempt to render <img src=x onerror=alert(1)>
# Ensure output is escaped text; never test against users.CSP violation / XSS in generated-content preview
2. Correct the responsible component
3. Verify and close exposure
The check confirms the expected result without exposing services or data.
Troubleshooting & Solutions
CSP violation / XSS in generated-content preview
Root cause: Trusting model output as HTML, disabling escaping or allowing `javascript:`/data URLs enables stored or reflected XSS.
Resolution: Render as text by default. If Markdown is required, use a maintained sanitiser with a narrow allowlist; validate URLs against policy-approved `https`/`http` schemes. Keep CSP as additional defence, not the only control.
Rollback and recovery plan
Restore the last approved configuration, stop the affected workflow and revoke any exposed credential. If real data was processed through an unauthorised path, retain minimal redacted records and follow the internal incident-response process.
Related runbooks in this category:
Was this technical guide helpful?
Facing a production outage?
Hosting Anayil system administrators can directly intervene on your server infrastructure.