WEB / WEB-16.S02

Command, template, and XML interpretation boundaries

Follow distinct owners of executables, template sources, XML grammar, and admitted data.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Fixed child

Interpretation intent ready
The example supplies profile command with value O'Reilly & Tea. The application has not run the interpreter; the result view contains no completed or admitted output.
Input value
O'Reilly & Tea
Contract gate
No selected profile
Interpreter
No completed interpretation
Result view
No result
Profile-contract selection
The application selects its Python executable and fixed argument-echo child code. O'Reilly & Tea is one argv value with shell=False. The profile grants no choice of executable or shell program.
Input value
O'Reilly & Tea
Contract gate
Application profile selected
Interpreter
No completed interpretation
Result view
No result
Interpretation completed
The child completed and returned JSON with argc=1 and title=O'Reilly & Tea. The apostrophe and ampersand remained in one title; the result view has not updated yet.
Input value
O'Reilly & Tea
Contract gate
Application profile selected
Interpreter
Completed interpretation; count=1
Result view
No result
Consumer-shape decision
The application sees one argument and the same title in completed echo output; command-data is ACCEPT. This admission does not validate another tool’s option, path or privilege policy.
Input value
O'Reilly & Tea
Contract gate
Output admitted
Interpreter
Completed interpretation; count=1
Result view
No result
Admitted output ready
Admitted consumer output is ready: argc=1; title=O'Reilly & Tea. This local preparation has not updated the result view; no new HTTP response or browser delivery is shown.
Input value
O'Reilly & Tea
Contract gate
Output admitted
Interpreter
argc=1; title=O'Reilly & Tea ready
Result view
No result
Result view completed
The result view now shows admitted output argc=1; title=O'Reilly & Tea. Interpreter completion differs from consumer use; this step is not evidence of browser rendering or another business action.
Input value
O'Reilly & Tea
Contract gate
Output admitted
Interpreter
argc=1; title=O'Reilly & Tea ready
Result view
argc=1; title=O'Reilly & Tea

Fixed template

Interpretation intent ready
The example supplies profile template with value Tea & Bread. The application has not run the interpreter; the result view contains no completed or admitted output.
Input value
Tea & Bread
Contract gate
No selected profile
Interpreter
No completed interpretation
Result view
No result
Profile-contract selection
The application selects fixed string.Template source $title. Tea & Bread is represented as Tea & Bread for HTML text; the title is not new template source.
Input value
Tea & Bread
Contract gate
Application profile selected
Interpreter
No completed interpretation
Result view
No result
Interpretation completed
Substitution in the fixed template produced string Tea & Bread. This is completed HTML-text serialization, not browser parsing or pixels.
Input value
Tea & Bread
Contract gate
Application profile selected
Interpreter
Completed interpretation; count=1
Result view
No result
Consumer-shape decision
The required title mapping exists and template-data output is ACCEPT. Fixed source and encoded value remain separate; this decision does not validate other output contexts or a full template engine.
Input value
Tea & Bread
Contract gate
Output admitted
Interpreter
Completed interpretation; count=1
Result view
No result
Admitted output ready
Admitted consumer output is ready: Tea & Bread. This local preparation has not updated the result view; no new HTTP response or browser delivery is shown.
Input value
Tea & Bread
Contract gate
Output admitted
Interpreter
Tea & Bread ready
Result view
No result
Result view completed
The result view now shows admitted output Tea & Bread. Interpreter completion differs from consumer use; this step is not evidence of browser rendering or another business action.
Input value
Tea & Bread
Contract gate
Output admitted
Interpreter
Tea & Bread ready
Result view
Tea & Bread

Book XML

Interpretation intent ready
The example supplies profile xml with value <book><title>Tea</title></book>. The application has not run the interpreter; the result view contains no completed or admitted output.
Input value
<book><title>Tea</title></book>
Contract gate
No selected profile
Interpreter
No completed interpretation
Result view
No result
Profile-contract selection
The application selects the XML profile with 128 bytes, depth=3 and nodes=16 limits. DTD rejection and external-entity policy are separate settings; book/title domain shape is checked after parsing.
Input value
<book><title>Tea</title></book>
Contract gate
Application profile selected
Interpreter
No completed interpretation
Result view
No result
Interpretation completed
XML grammar parsing completed with root=book, title=Tea and executions=1. The parsed tree is not yet an admitted book record; the result view is unchanged.
Input value
<book><title>Tea</title></book>
Contract gate
Application profile selected
Interpreter
Completed interpretation; count=1
Result view
No result
Consumer-shape decision
Root book, one title child and no attributes/nested children satisfy the domain contract. xml-record is ACCEPT; only the title=Tea projection is admitted.
Input value
<book><title>Tea</title></book>
Contract gate
Output admitted
Interpreter
Completed interpretation; count=1
Result view
No result
Admitted output ready
Admitted consumer output is ready: title=Tea. This local preparation has not updated the result view; no new HTTP response or browser delivery is shown.
Input value
<book><title>Tea</title></book>
Contract gate
Output admitted
Interpreter
title=Tea ready
Result view
No result
Result view completed
The result view now shows admitted output title=Tea. Interpreter completion differs from consumer use; this step is not evidence of browser rendering or another business action.
Input value
<book><title>Tea</title></book>
Contract gate
Output admitted
Interpreter
title=Tea ready
Result view
title=Tea

Wrong XML root

Interpretation intent ready
The example supplies profile xml with value <display><title>Tea</title></display>. The application has not run the interpreter; the result view contains no completed or admitted output.
Input value
<display><title>Tea</title></display>
Contract gate
No selected profile
Interpreter
No completed interpretation
Result view
No result
Profile-contract selection
The application selects the XML profile with 128 bytes, depth=3 and nodes=16 limits. DTD rejection and external-entity policy are separate settings; book/title domain shape is checked after parsing.
Input value
<display><title>Tea</title></display>
Contract gate
Application profile selected
Interpreter
No completed interpretation
Result view
No result
Interpretation completed
XML grammar parsing completed with root=display, title=Tea and executions=1. The parsed tree is not yet an admitted book record; the result view is unchanged.
Input value
<display><title>Tea</title></display>
Contract gate
Application profile selected
Interpreter
Completed interpretation; count=1
Result view
No result
Consumer-shape decision
Root display fails the book/title contract. Although grammar parsing completed, xml-shape is REJECT; title=Tea is not converted into an admitted book projection.
Input value
<display><title>Tea</title></display>
Contract gate
Rejected: xml-shape
Interpreter
Completed interpretation; count=1
Result view
No result
Rejected XML output withheld
XML parsing completed, but the display root failed the book contract. Output stays null; no admitted record is prepared for the consumer.
Input value
<display><title>Tea</title></display>
Contract gate
Rejected: xml-shape
Interpreter
Parsed tree only; output null
Result view
No result
Result view completed
The view shows xml-shape rejection and output=null. The parsed display/title tree is not presented as an admitted Tea book or empty success.
Input value
<display><title>Tea</title></display>
Contract gate
Rejected: xml-shape
Interpreter
Parsed tree only; output null
Result view
No result; xml-shape

ACTORS · STATE · DATA FLOW

Choosing the interpreter is not an input responsibility

An Atlas book title can be an argument to a fixed program, a value in a fixed template, or a field in a fixed XML record. Those roles do not share one universal string rule. The application selects the operation profile; supplying a title does not grant authorship of an executable, template source, or XML query expression. The typed record from the validation lesson now meets a contract governing its next interpretation boundary.

The artifact uses only four fixed ordinary cases: O'Reilly & Tea as a child argument, Tea & Bread as HTML text, a book/title XML record, and an ordinary display/title record. A missing profile is NOT-COMPUTED, while an unknown profile is REJECT. Passing a type or length check does not establish completed interpretation. The native result separately records the interpreter’s actual output and whether the application consumes an accepted record.

Command arguments and shell programs are distinct

The native check starts its own Python executable with fixed child code and one title argument supplied as a sequence. It uses shell=False. The child returns only an argument count and title as JSON: O'Reilly & Tea remains one title and argc=1 is observed. This is not a shell-escaping recipe. Program source and executable are application constants; the title cannot choose them.

Argument separation still does not replace business policy. Some tools interpret arguments as options, paths, or destinations, requiring their own approved operation contracts. This child has no option parser and performs no network/file operation. A literal child environment, timeout=5, and check=True define the selected run profile; a timeout is not general OS resource-isolation evidence. Observation is on macOS. Python’s Windows batch-file caveat is a reminder not to collapse every platform into one behavior.

Template source is fixed and values remain separate

Here Python string.Template uses application-owned source $title. Tea & Bread is serialized as Tea & Bread for HTML text context, then substituted as the title value. The completed string is Tea & Bread. Selecting template source and encoding output answer different questions: which presentation program the server interprets, and how a value is represented in the target text context.

An ordinary $catalog label supplied as a value receives no second substitution pass. The native check observes this with a fixed Book: $title template. Python string.Template is neither Python 3.14 t-strings nor a full Jinja/Twig engine. Its small result does not establish the security of every server-side template sandbox. Combining user input into template source changes source/data ownership; this lesson executes no client-authored template or vulnerability payload.

XML parsing and domain records are separate stages

The XML case reads a memory stream within 128 UTF-8 bytes and a selected small tree budget. The installed SAX parser has external-general and external-parameter entity features set to false. Its lexical startDTD callback rejects every DTD declaration. The entity resolver rejects instead of opening an outside resource. These selections are not inferred from a generic parser name: native evidence records actual feature values.

Ordinary <book><title>Tea</title></book> parses. The application then checks a book root, exactly one title child, no attributes, no nested child, and a title of 1–40 code points. <display><title>Tea</title></display> parses grammatically but fails the domain shape. Consequently XML execution count=1 can coexist with null accepted output. Showing a parsed tree as a consumed book would conflate two distinct boundaries.

XML trees, XPath selection, and external resources differ

An application-owned title path is selected with ElementTree find. This library provides a limited ElementPath/XPath subset; the native check does not execute a full XPath engine. The caller’s title value is not appended to a selection expression. Validating XML fields and owning a query-language expression are separate responsibilities. Namespaces and other schema profiles are outside this small book format.

External entity resolution is different from XML node selection: a resolver may cross a resource-access boundary. No external reference or entity payload is supplied here. A harmless empty DTD declaration is rejected by the selected callback to observe the policy taking effect. Resolver calls in ordinary cases are 0. That observation is not conformance or network-isolation evidence for every XML library, XSLT transform, expansion case, or general resource-exhaustion condition.

Read every scenario without motion

XML shape

The XML consumer contract was selected
The XML profile requires book/title without attributes or nested children. Input display/title does not establish the same application record merely by being well formed.
Interpreter source/input
display/title input
Interpretation/consumer gate
No parser outcome
Output boundary
No book record
Parser budgets were read separately
byteBudget=128, maxDepth=3 and maxNodes=16 are selected. A small ordinary XML input fitting these budgets does not complete domain-shape acceptance.
Interpreter source/input
Bounded XML input
Interpretation/consumer gate
Budget context known
Output boundary
No book record
The interpretation outcome was separated from the consumer
The expected xml-shape row has executions=1; interpretation ran. A display root does not match the book/title record-extraction rule.
Interpreter source/input
Parsed display root
Interpretation/consumer gate
Shape mismatch known
Output boundary
No accepted book record
Output projection was withheld
decision=REJECT, reason=xml-shape and output=null remain. Parsed title Tea is not displayed as an accepted Tea book record in the consumer.
Interpreter source/input
Parsed data exists
Interpretation/consumer gate
Consumer rejected shape
Output boundary
Output=null
Parser configuration was not substituted for schema
DTD rejection and external-entity feature flags are separate interpreter controls. Selecting them does not permit an incorrect application root.
Interpreter source/input
Interpreter profile known
Interpretation/consumer gate
Domain shape remains required
Output boundary
Output=null
The failure owner remained correct
This branch is consumer-shape rejection, not syntax failure. It adds no claim of external XML, entity expansion or exploit-payload execution.
Interpreter source/input
Known: interpretation ran
Interpretation/consumer gate
Known: xml-shape denial
Output boundary
No accepted output

Command data

The application-owned process source was selected
The application selects the executable and fixed argument-echo child. Title O'Reilly & Tea is a data argument, not program source.
Interpreter source/input
Fixed echo profile
Interpretation/consumer gate
Data argument being prepared
Output boundary
No output
Shell and argument contracts were separated
shell=false and titleArguments=1 are supplied. Preserving an ampersand or apostrophe does not grant the capability to select arbitrary commands.
Interpreter source/input
Title data only
Interpretation/consumer gate
One argument; shell=false
Output boundary
No output
Completed child output was read
Expected output has argc=1 and title=O'Reilly & Tea. The consumer is not assumed to know it before child completion; this scene reviews the completed observation.
Interpreter source/input
Fixed process interpretation
Interpretation/consumer gate
Completed argc=1 output
Output boundary
Harmless title preserved
Successful echo was not treated as semantic permission
Preserving one argument does not verify option, destination or privilege policy for a conversion tool. shell=false is not a complete process sandbox.
Interpreter source/input
One data argument retained
Interpretation/consumer gate
Source/data boundary explicit
Output boundary
No arbitrary-tool permission
The interpreter role was not transferred to other sinks
A command-argument boundary is not the same API as template source or an XML path. Each interpreter needs its own trusted-source and data-slot contract.
Interpreter source/input
Command data role known
Interpretation/consumer gate
Other interpreter contracts separate
Output boundary
No universal interpretation claim
The native-observation scope was preserved
The artifact shows data output from the fixed echo; this scene launches no new process. It adds no arbitrary-command, network-isolation or general-sandbox guarantee.
Interpreter source/input
Known: fixed argument observation
Interpretation/consumer gate
Known: title preserved
Output boundary
Broader process safety unverified

ASSUMPTION · BOUNDARY · CONTROL

A review follows who chooses each source

The same ownership question helps with commands, templates, and XPath: which trusted code selects the interpretation source, and which fields arrive only as data? Program identity, child source, template source, and fixed title path remain distinct in the artifact. Preserving an ordinary title is evidence about a value boundary. It does not imply that the caller may choose executables or expressions.

A report should not use the library name alone as its conclusion. shell=False does not automatically validate command semantics; HTML encoding does not establish server-template source ownership; an XML feature flag does not complete schema validation. Each belongs to a different boundary. These checks observe a narrow installed-runtime profile and perform no command/template/XML exploit attempt on a target.

An interpreter may succeed while its consumer rejects

In the XML wrong-root case, parsing completion is an observed fact; admitting a book record is a different application decision. Execution count=1 and null output are retained together. Calling it only a parse error would hide the real failure boundary. For commands, the result view waits for actual child stdout. For templates, no browser-render outcome is attached to the serialized output.

Missing and unknown profiles also remain distinct. Inventing a policy decision from missing evidence makes it unclear which source an audit actually inspected. Profile identity, typed value, completed output, and consumer decision provide a useful starting point. No interpreter or private file is accessed beyond the fixed native child code, trusted template, and own memory XML. Evidence remains limited to these ordinary observations.

Read every scenario without motion

Template output

The template source/data observation was selected
Template source is fixed $title using string.Template, not a t-string. Source selection and title data are recorded separately.
Interpretation observation
Fixed template source
Profile/result review
Mapping not examined
Evidence conclusion
No render evidence
The harmless-title mapping was read
Input Tea & Bread is a title value. It is mapped to the application’s fixed slot; it selects neither a source registry nor another template program.
Interpretation observation
Tea & Bread data
Profile/result review
Fixed $title slot
Evidence conclusion
No render evidence
HTML text serialization was compared
Expected output is Tea & Bread. executions=1 belongs to this selected transformation, not browser parsing.
Interpretation observation
Raw title known
Profile/result review
HTML text output known
Evidence conclusion
Browser parse not observed
The context-specific encoder boundary was preserved
Correct HTML text output does not complete attribute, URL or script encoding rules. Template-source ownership and output encoding are also different controls.
Interpretation observation
Fixed text context
Profile/result review
Other context rules separate
Evidence conclusion
No universal template safety claim
Missing mapping was not treated as empty success
The consumer requires title. A missing required mapping is not assumed to produce an accepted empty book or output; the library error is observed separately.
Interpretation observation
Required title mapping
Profile/result review
Missing-data handling separate
Evidence conclusion
No guessed empty success
Transformation evidence was scoped
The ledger explains fixed-template serialization of a benign title. A full template engine, server permission and client pixels need separate runtime evidence.
Interpretation observation
Known: fixed source/data roles
Profile/result review
Known: encoded public output
Evidence conclusion
UNKNOWN: client rendering

Profile missing

The missing-profile observation was selected
missing.profile=null shows insufficient input about the selected interpreter contract. A normal command or XML branch is not substituted automatically.
Interpretation observation
Profile=null
Profile/result review
Interpreter not selected
Evidence conclusion
No output
The NOT-COMPUTED outcome was read
decision=NOT-COMPUTED is supplied. It is neither known xml-shape rejection nor accepted command-data output.
Interpretation observation
Profile=null
Profile/result review
Decision NOT-COMPUTED
Evidence conclusion
No output
The execution counter was read separately
executions=0 preserves the branch where no interpreter ran. Missing input does not establish syntax, child-exit or crypto failure.
Interpretation observation
Profile=null
Profile/result review
Executions=0
Evidence conclusion
No interpreter outcome
Consumer output remained absent
output=null remains. Without known scope, title Tea or the normal template body is not shown as an accepted consumer result.
Interpretation observation
Profile=null
Profile/result review
No accepted projection
Evidence conclusion
Output=null
Source and profile evidence were requested
Profile name, typed input and completed results require their own sources. A UI option name does not fill the missing execution decision.
Interpretation observation
Missing profile known
Profile/result review
Profile/input/result evidence required
Evidence conclusion
UNKNOWN: intended interpretation
The missing-profile conclusion was not broadened
No execution is known in this case; which interpreter would succeed or fail is unknown. No arbitrary-input processing or private-file reading follows.
Interpretation observation
Known: no interpreter execution
Profile/result review
Known: output withheld
Evidence conclusion
UNKNOWN: intended profile outcome

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Close the profile and consumer contracts together

Prefer built-in libraries where they can remove the need for process invocation. When a process is required, begin with an application-owned executable and fixed arguments rather than assembling text as a shell program. This child only returns a title. A real conversion tool additionally needs option/destination policy, privileges, and resource limits. Successful argc=1 does not establish those controls.

Keep template-source registries separate from data mappings. Encode HTML text for that context; attributes, URLs, and script contexts need different rules. For XML, record parser configuration, DTD policy, external-resolver policy, and domain shape separately. When a parser changes, check that those settings remain supported and produce the expected results; an unchanged library name is insufficient.

Consume only admitted completed output

Do not hand consumers an entire parsed tree or incomplete child state. Approved records/projections are prepared after completed interpretation; rejected shapes retain null output. The XML display root never becomes an admitted Tea book in the view. Missing a required template value produces an observed KeyError; missing data is not assumed to become automatic empty success.

Regression checks need independently specified outputs: the ordinary title returns as one child argument, the ampersand is correctly serialized in fixed HTML text, book/title is selected, and the display root is rejected. The harmless DTD case verifies only callback rejection. Network isolation, arbitrary entity expansion, command sandboxes, full template engines, and full XPath conformance require additional evidence. Disabling motion preserves the same output and decision as readable text.

NOW APPLY IT TO THE CASE

Which consumer acceptance remains beyond interpreter success?

Fixed command, template and XML profiles separate source and data roles. Shape denial and a missing profile are different outcomes.

Reconstruct decision order for input, server processing and response in the case. Parsed or valid data is not a completed operation; identify each owner and its condition.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Atlas interpreter and admitted-output ledger

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "profiles": {
    "command": {
      "executable": "own Python runtime",
      "source": "fixed argument echo child",
      "shell": false,
      "titleArguments": 1,
      "timeoutSeconds": 5,
      "childEnvironment": {
        "PYTHONIOENCODING": "utf-8"
      }
    },
    "template": {
      "source": "<p>$title</p>",
      "library": "string.Template; not t-string",
      "encoding": "HTML text"
    },
    "xml": {
      "byteBudget": 128,
      "maxDepth": 3,
      "maxNodes": 16,
      "DTD": "reject startDTD",
      "externalGeneralEntities": false,
      "externalParameterEntities": false,
      "path": "title",
      "shape": "book/title with no attributes/nested child"
    }
  },
  "inputs": {
    "command": {
      "profile": "command",
      "value": "O'Reilly & Tea"
    },
    "template": {
      "profile": "template",
      "value": "Tea & Bread"
    },
    "xml": {
      "profile": "xml",
      "value": "<book><title>Tea</title></book>"
    },
    "xml-shape": {
      "profile": "xml",
      "value": "<display><title>Tea</title></display>"
    }
  },
  "expected": {
    "command": {
      "decision": "ACCEPT",
      "reason": "command-data",
      "executions": 1,
      "output": {
        "argc": 1,
        "title": "O'Reilly & Tea"
      }
    },
    "template": {
      "decision": "ACCEPT",
      "reason": "template-data",
      "executions": 1,
      "output": "<p>Tea &amp; Bread</p>"
    },
    "xml": {
      "decision": "ACCEPT",
      "reason": "xml-record",
      "executions": 1,
      "output": {
        "title": "Tea"
      }
    },
    "xml-shape": {
      "decision": "REJECT",
      "reason": "xml-shape",
      "executions": 1,
      "output": null
    }
  },
  "missing": {
    "profile": null,
    "decision": "NOT-COMPUTED",
    "executions": 0,
    "output": null
  }
}

profiles: Application-owned sources, configuration, and selected consumer contracts.
executions: Completed child/substitution/parse; XML shape rejection may follow parsing.
output: Admitted consumer output; null for rejected shape.
missing: No interpretation outcome is invented for absent profile evidence.

Own fixed Python child, string.Template/HTML text, and bounded ordinary SAX/limited ElementPath. No shell, executable client template, XXE payload, external resource, full XPath/engine sandbox, browser, or authorization executes.

Two reality checks

shell=False validates every argument’s semantics.

The shell boundary differs from a tool’s option/path/destination policy.

XML parsing or HTML escaping closes every interpretation boundary.

Source ownership, parser policy, schema, and output context require separate decisions.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

XML parsing runs, but the root is display while the contract requires book/title. Is the output record accepted?

Yes. If title text exists, every XML root is equivalent.
No. xml-shape yields REJECT with output=null.

Read the explained answer

No. xml-shape yields REJECT with output=null. — executions=1 shows the parser ran, not that the root/child contract was accepted.

Why does the O’Reilly & Tea title remain a single data argument in this command example?

Selected lesson artifact fields; teaching example

profiles.command.shell: false
profiles.command.titleArguments: 1
inputs.command.value: O'Reilly & Tea
expected.command.output: {"argc":1,"title":"O'Reilly & Tea"}

shell=false and output argc=1.
An ampersand always executes a second command.

Read the explained answer

shell=false and output argc=1. — The title is a separate argv value for the fixed echo child. The contract does not use it as shell source or executable selection.

The fixed template source is $title, with output Tea & Bread. Why is one escaping solution insufficient for templates, commands and XML?

Read the explained answer

The template inserts HTML-text-encoded data into fixed string.Template source; data is not new template source. The command uses separate argv with shell=false. XML has its own byte/depth/node, DTD and entity policies. Encoding for one context does not satisfy every condition of another interpreter. These finite examples offer no arbitrary template, command or XML runtime.

□ I separated data from interpreter source.

□ I stated the separate grammar and policy conditions of each context.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

OWASP — OS Command Injection DefenseDefense Option 1: Avoid calling OS commands directly · Defense option 3: Parameterization in conjunction with Input Validation
Python — subprocessSecurity Considerations · subprocess.run; timeout/check/env
Python — stringTemplate strings ($-strings); distinct from t-strings · Template.substitute
PortSwigger — Server-side template injectionWhat is server-side template injection?; source/data definition only
Python — xml.sax.handlerLexicalHandler.startDTD · feature_external_ges / feature_external_pes · EntityResolver.resolveEntity
OWASP — XML External Entity PreventionGeneral Guidance; DTD and external resource policy
Python — ElementTreeXPath support; limited subset · Supported XPath syntax; tag selection
Python — htmlhtml.escape

YOUR NOTES / THIS BROWSER

Command, template, and XML interpretation boundaries

1. Core · Mechanism

Fixed child

Fixed template

Book XML

Wrong XML root

Choosing the interpreter is not an input responsibility

Command arguments and shell programs are distinct

Template source is fixed and values remain separate

XML parsing and domain records are separate stages

XML trees, XPath selection, and external resources differ

2. Red · Trust & Impact

XML shape

Command data

A review follows who chooses each source

An interpreter may succeed while its consumer rejects

3. Blue · Secure development & defense

Template output

Profile missing

Close the profile and consumer contracts together

Consume only admitted completed output

Which consumer acceptance remains beyond interpreter success?

Two reality checks

XML parsing runs, but the root is display while the contract requires book/title. Is the output record accepted?

Why does the O’Reilly & Tea title remain a single data argument in this command example?

The fixed template source is <p>$title</p>, with output <p>Tea &amp; Bread</p>. Why is one escaping solution insufficient for templates, commands and XML?

Sources and scope

The fixed template source is <p>$title</p>, with output <p>Tea & Bread</p>. Why is one escaping solution insufficient for templates, commands and XML?