Design a secure templating engine for user notifications

WHAT THIS TESTS: This question evaluates whether you can design a domain-specific language and runtime that gives content creators expressive power while maintaining strict security and grammatical correctness across languages. Interviewers want to see defense-in-depth, not just a single sanitization step.

A GOOD ANSWER COVERS: First, parsing strategy: use a formal grammar and generate an abstract syntax tree rather than regex substitution, because regex fails on nested conditionals and enables injection. Second, security layers: context-aware auto-escaping where the engine knows whether the output target is HTML email, plain text push, or JSON, and applies the correct encoder for that context. Third, logic primitives: restrict the AST to a whitelist of nodes like variable interpolation, if-else, and ICU MessageFormat selectors for pluralization and gender, rather than exposing general-purpose scripting. Fourth, execution sandbox: run template rendering inside a sandbox with CPU time limits, memory caps, and a denylist of system calls to prevent denial of service from infinite loops or recursion. Fifth, internationalization: integrate CLDR data or ICU MessageFormat so translators can handle complex plural rules like Polish or Arabic without engineering changes.

COMMON WRONG ANSWERS: Suggesting that HTML sanitization on the final string is enough, because that ignores other contexts like SMS or JSON payloads. Proposing to let content authors write raw JavaScript or Python inside templates for flexibility. Using simple string replacement for variables, which breaks when translators reorder words or when user input contains reserved characters. Ignoring locale-specific plural forms and assuming every language uses one versus many.

LIKELY FOLLOW-UPS: How would you handle user-generated templates from untrusted creators rather than just internal staff? What changes if the output channel is a mobile push notification versus an HTML email? How do you cache rendered templates without leaking data across users? How would you version templates and roll back a bad change instantly?

ONE CONCRETE EXAMPLE: Imagine a ride-sharing app sending a receipt. A content creator writes a template that says "You took {count} ride(s) and saved {amount}." The engine parses this into an AST, validates that only allowed variables appear, replaces count with an ICU plural selector that renders "1 ride" or "2 rides" based on English rules but switches to Polish paucal forms for pl locales, escapes amount into HTML entities for email but leaves it unescaped for push, and renders the whole tree inside a sandbox that aborts if execution exceeds ten milliseconds.

Source: Wikipedia: Template processor