HTX Guide · 1.5.0-alpha.2

Security profiles

Trusted, content-only, and untrusted-data modes.

HTX 1.5.0-alpha.2 (reference implementation 0.3.0-alpha.3) — Features below are available in the htx CLI unless noted as browser-only.

Status: Shipped — parse-time profiles and ::data quarantine in reference implementation 0.3.0-alpha.3

Threat model

HTX documents may flow through AI agent pipelines where:

  1. Trusted content is authored by the system or verified humans
  2. Untrusted content is fetched from web, email, user input, databases
  3. Indirect prompt injection embeds instructions in markup that agents execute

HTX addresses this at the parser/compiler layer, not by hoping the LLM ignores instructions.

Two layers of safety

Layer When What
Security profile (parse-time) Strips or quarantines directives; sets AST trust
html-sanitize profile (compile-time) Strips dangerous URLs, tags, attributes from output

Use both for user-generated content preview.

Profiles

Profile Block directives Inline directives Nested blocks AST trust Use case
trusted Full Full Full trusted Internal docs, verified authoring
content-only Stripped → text Stripped → text N/A untrusted Display untrusted prose safely
untrusted-data Only ::data wrapper Stripped Flat text inside ::data untrusted Quarantined user content

::data scope

::data { type="untrusted-user-content" source="email-123" }
  # This heading is text, not a directive
  ::fake { .inject } — parsed as literal text, not a block
::

Compiler rules

  1. Inside ::data, :: at line start is escaped or treated as text unless \::
  2. No block/inline directives produce AST nodes inside ::data — only text, paragraph, etc.
  3. type attribute is required; drives downstream handling
  4. Symbol table entries inside ::data are not referenceable via (@id)

Information-flow inspiration

Microsoft’s FIDES and BIPIA research recommend boundary awareness: untrusted content must not drive tool calls or structural overrides. HTX’s approach:

  • Structural syntax is disabled in untrusted scopes
  • AST carries trust: "untrusted" annotation on subtrees
  • Agents can filter AST nodes by trust before prompting

Defense in depth

HTX security profiles are one layer. Also required:

  • Output encoding (HTML escape)
  • URL allowlists (html-sanitize profile)
  • Human confirmation for agent actions
  • Prompt shields (probabilistic) for natural language outside HTX

Conformance tests (planned)

  • Malicious ::section inside ::data → no block_directive in AST
  • (@id) reference to id inside ::data → diagnostic error
  • Nested ::data → flat text only

References