11// Copyright (c) Microsoft. All rights reserved.
22
3+ using System . Web ;
34using Microsoft . SemanticKernel ;
45using Microsoft . SemanticKernel . PromptTemplates . Handlebars ;
56using Resources ;
@@ -43,14 +44,15 @@ Make sure to reference the customer by name response.
4344 """ ;
4445
4546 // Input data for the prompt rendering and execution
47+ // Performing manual encoding for each property for safe content rendering
4648 var arguments = new KernelArguments ( )
4749 {
4850 { "customer" , new
4951 {
50- firstName = "John" ,
51- lastName = "Doe" ,
52- age = 30 ,
53- membership = "Gold" ,
52+ firstName = HttpUtility . HtmlEncode ( "John" ) ,
53+ lastName = HttpUtility . HtmlEncode ( "Doe" ) ,
54+ age = HttpUtility . HtmlEncode ( 30 ) ,
55+ membership = HttpUtility . HtmlEncode ( "Gold" ) ,
5456 }
5557 } ,
5658 { "history" , new [ ]
@@ -67,6 +69,14 @@ Make sure to reference the customer by name response.
6769 Template = template ,
6870 TemplateFormat = "handlebars" ,
6971 Name = "ContosoChatPrompt" ,
72+ InputVariables = new ( )
73+ {
74+ // Set AllowDangerouslySetContent to 'true' only if arguments do not contain harmful content.
75+ // Consider encoding for each argument to prevent prompt injection attacks.
76+ // If argument value is string, encoding will be performed automatically.
77+ new ( ) { Name = "customer" , AllowDangerouslySetContent = true } ,
78+ new ( ) { Name = "history" , AllowDangerouslySetContent = true } ,
79+ }
7080 } ;
7181
7282 // Render the prompt
@@ -93,18 +103,26 @@ public async Task LoadingHandlebarsPromptTemplatesAsync()
93103 var handlebarsPromptYaml = EmbeddedResource . Read ( "HandlebarsPrompt.yaml" ) ;
94104
95105 // Create the prompt function from the YAML resource
96- var templateFactory = new HandlebarsPromptTemplateFactory ( ) ;
106+ var templateFactory = new HandlebarsPromptTemplateFactory ( )
107+ {
108+ // Set AllowDangerouslySetContent to 'true' only if arguments do not contain harmful content.
109+ // Consider encoding for each argument to prevent prompt injection attacks.
110+ // If argument value is string, encoding will be performed automatically.
111+ AllowDangerouslySetContent = true
112+ } ;
113+
97114 var function = kernel . CreateFunctionFromPromptYaml ( handlebarsPromptYaml , templateFactory ) ;
98115
99116 // Input data for the prompt rendering and execution
117+ // Performing manual encoding for each property for safe content rendering
100118 var arguments = new KernelArguments ( )
101119 {
102120 { "customer" , new
103121 {
104- firstName = "John" ,
105- lastName = "Doe" ,
106- age = 30 ,
107- membership = "Gold" ,
122+ firstName = HttpUtility . HtmlEncode ( "John" ) ,
123+ lastName = HttpUtility . HtmlEncode ( "Doe" ) ,
124+ age = HttpUtility . HtmlEncode ( 30 ) ,
125+ membership = HttpUtility . HtmlEncode ( "Gold" ) ,
108126 }
109127 } ,
110128 { "history" , new [ ]
0 commit comments