Step 3 / Select topic Backend Security Easy

What this bank covers

• Classic tautology injection
• Parameters treat input as data
• Placeholder styles
• Comment-out injection
• Allow-list input validation
• Numeric validation stops numeric-context injection
• UNION-based injection
• Parameters cannot replace identifiers
• Comment payloads discard the rest of a query line
• Concatenated input adds a command
• shlex.quote neutralizes metacharacters
• Shell chaining metacharacters
• argv lists avoid the shell
• Character allow-lists for shell input
• Command substitution payloads
• shlex.split is not a shell
• Deny-lists miss metacharacters
• Choosing a shell-free exec call
• Spotting shell metacharacters in untrusted input
• normpath collapses .. segments
• os.path.join and absolute segments
• Percent-encoded traversal
• Prefix check after normalization
• Counting escaping inputs
• '..' above the root is dropped
• Spotting encoded traversal payloads
• basename strips every directory component
• Prefix string checks leak into sibling directories
• Link-local range and metadata IPs
• Userinfo tricks in SSRF payloads
• Counting private addresses
• Substring deny lists miss encoded IPs
• Scheme allow lists
• Resolving relative redirects
• 0.0.0.0 is not loopback
• Reading the target port
• Exact host matching beats prefix checks
• IPv6 hosts in URLs
• Per-user salts change the digest
• Constant-time token comparison
• Splitting a Bearer credential
• Counting passwords that satisfy a policy
• Basic auth is encoded, not encrypted
• Reading claims out of a JWT payload
• Comparing an exp claim with the current time
• Unknown session ids fall back to anonymous
• Password hash comparison is case sensitive
• Login lockout threshold
• HttpOnly on session cookies
• Idle session timeout
• Absolute session lifetime
• SameSite=None requires Secure
• Hex session token length
• Counting live sessions in SQL
• Reading the session cookie from a header
• Session id rotation on login
• Counting a user's active sessions
• Counting users that pass a role check
• Object ownership check
• Permission sets per role
• Role hierarchy and inherited permissions
• Scoping a query to the current user
• Trusting a client supplied role
• Wildcard scope matching
• Permission lookup in a join table
• Explicit deny overriding an allow rule
• Default-deny role checks
• JSON objects deserialize to dicts
• pickle calls callables while loading
• Strict JSON syntax on input
• Pickle and JSON are different wire formats
• JSON round trips lose Python types
• Duplicate keys when deserializing JSON
• Prototype pollution from parsed JSON
• Verify the signature before deserializing
• Only pickle executes reduce payloads
• JSON.parse rejects trailing commas
• Hash determinism
• SHA-256 hex digest length
• HMAC depends on the key
• Base64 is encoding, not encryption
• Bits to bytes for key sizes
• Cryptographically secure randomness
• XOR stream decryption
• Postgres md5() returns hex text
• Comparing digest sizes
• MD5 hex digest length
• Anchored allow-list pattern
• isdigit plus range check
• Character length vs byte length
• Server-side validation in SQL
• Truthiness is not validation
• bool is a subclass of int
• int() rejects decimal strings
• fullmatch requires the whole pattern
• Strip before checking for emptiness
• Validate the normalized value consistently
• Escaping a literal in PostgreSQL
• abspath collapses traversal segments
• Revoking every session for one user