- 
                Notifications
    You must be signed in to change notification settings 
- Fork 4.3k
Python: .Net: Updated encoding logic in prompt templates #12983
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
          
     Merged
      
      
    
                
     Merged
            
            
          Conversation
  
    
      This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
      Learn more about bidirectional Unicode characters
    
  
  
    
    
              
                    westey-m
  
              
              approved these changes
              
                  
                    Aug 21, 2025 
                  
              
              
            
            
        
          
                .../Extensions/Extensions.UnitTests/PromptTemplates/Handlebars/HandlebarsPromptTemplateTests.cs
          
            Show resolved
            Hide resolved
        
      | Python Test Coverage Report •
 Python Unit Test Overview
 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
              
                    moonbox3
  
              
              approved these changes
              
                  
                    Aug 22, 2025 
                  
              
              
            
            
  This was referenced Sep 10, 2025 
      
    
  jcruzmot-te 
      pushed a commit
        to thousandeyes/aia-semantic-kernel
      that referenced
      this pull request
    
      Sep 15, 2025 
    
    
      
  
    
      
    
  
…2983) ### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Resolves: microsoft#11821 Today, the encoding of template arguments is performed only if argument type is `string`. In case of custom type, anonymous type or collection - the encoding is not performed. This PR contains changes to throw an exception in case if encoding is enabled but complex type is used. In case of complex type, the encoding should be performed manually according to business logic and automatic encoding should be explicitly disabled. This enforces stricter, but more secure template rendering rules. **Note**: this is a breaking change for customers who use Handlebars or Liquid template with complex type arguments. Code changes are required when initializing template arguments: ```diff var arguments = new KernelArguments() { { "customer", new { - firstName = userInput.FirstName, - lastName = userInput.LastName, + firstName = HttpUtility.HtmlEncode(userInput.FirstName), + lastName = HttpUtility.HtmlEncode(userInput.LastName), } } }; var templateFactory = new LiquidPromptTemplateFactory(); var promptTemplateConfig = new PromptTemplateConfig() { TemplateFormat = "liquid" + InputVariables = new() + { + // We set AllowDangerouslySetContent to 'true' because each property of this argument is encoded manually. + new() { Name = "customer", AllowDangerouslySetContent = true }, + } }; var promptTemplate = templateFactory.Create(promptTemplateConfig); var renderedPrompt = await promptTemplate.RenderAsync(kernel, arguments); ``` ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄
  This was referenced Sep 20, 2025 
      
  This was referenced Oct 1, 2025 
      
      
     Closed
  
      
     Merged
  
    
      Bump Microsoft.SemanticKernel from 1.61.0 to 1.65.0
      microsoft/Generative-AI-for-beginners-dotnet#385
  
  
      
     Merged
  
  This was referenced Oct 12, 2025 
    
      Bump Microsoft.SemanticKernel from 1.61.0 to 1.66.0
      microsoft/Generative-AI-for-beginners-dotnet#389
  
  
      
     Merged
  
    
      Bump Microsoft.SemanticKernel from 1.61.0 to 1.66.0
      microsoft/Generative-AI-for-beginners-dotnet#403
  
  
      
     Merged
  
      
     Closed
  
      
     Merged
  
  This was referenced Oct 22, 2025 
      
  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment
  
      Labels
      
    kernel
  Issues or pull requests impacting the core kernel 
  
    .NET
  Issue or Pull requests regarding .NET code 
  
    PR: breaking change
  Pull requests that introduce breaking changes 
  
    python
  Pull requests for the Python Semantic Kernel 
  Add this suggestion to a batch that can be applied as a single commit.
  This suggestion is invalid because no changes were made to the code.
  Suggestions cannot be applied while the pull request is closed.
  Suggestions cannot be applied while viewing a subset of changes.
  Only one suggestion per line can be applied in a batch.
  Add this suggestion to a batch that can be applied as a single commit.
  Applying suggestions on deleted lines is not supported.
  You must change the existing code in this line in order to create a valid suggestion.
  Outdated suggestions cannot be applied.
  This suggestion has been applied or marked resolved.
  Suggestions cannot be applied from pending reviews.
  Suggestions cannot be applied on multi-line comments.
  Suggestions cannot be applied while the pull request is queued to merge.
  Suggestion cannot be applied right now. Please check back later.
  
    
  
    
Motivation and Context
Resolves: #11821
Today, the encoding of template arguments is performed only if argument type is
string. In case of custom type, anonymous type or collection - the encoding is not performed.This PR contains changes to throw an exception in case if encoding is enabled but complex type is used. In case of complex type, the encoding should be performed manually according to business logic and automatic encoding should be explicitly disabled.
This enforces stricter, but more secure template rendering rules.
Note: this is a breaking change for customers who use Handlebars or Liquid template with complex type arguments. Code changes are required when initializing template arguments:
var arguments = new KernelArguments() { { "customer", new { - firstName = userInput.FirstName, - lastName = userInput.LastName, + firstName = HttpUtility.HtmlEncode(userInput.FirstName), + lastName = HttpUtility.HtmlEncode(userInput.LastName), } } }; var templateFactory = new LiquidPromptTemplateFactory(); var promptTemplateConfig = new PromptTemplateConfig() { TemplateFormat = "liquid" + InputVariables = new() + { + // We set AllowDangerouslySetContent to 'true' because each property of this argument is encoded manually. + new() { Name = "customer", AllowDangerouslySetContent = true }, + } }; var promptTemplate = templateFactory.Create(promptTemplateConfig); var renderedPrompt = await promptTemplate.RenderAsync(kernel, arguments);Contribution Checklist