Step 3 / Select topic Backend Security Hard

What this bank covers

• quote_literal for dynamic SQL values
• format('%I') for identifiers
• Wildcards survive parameter binding
• Knowing your driver's paramstyle
• quote_nullable handles missing values
• Bound parameters are data, not SQL
• quote_ident on a mixed-case name
• shlex.quote on a value with a separator
• Quoting an empty argument
• shlex.split does not expand substitutions
• Quoting does not stop argument injection
• shlex.quote's safe character set
• POSIX single-quote escaping in JavaScript
• Non-global replace leaves metacharacters behind
• Counting shell metacharacters in a built command
• Allow-list stripping before building a command
• Anchored allow-list regex as a gate
• os.path.join and absolute second arguments
• normpath can leave escaping '..' segments
• Double URL encoding survives one decode
• Single-pass stripping of '../' is bypassable
• Backslashes are ordinary characters on POSIX
• is_relative_to does not resolve '..'
• commonpath compares components, not characters
• Prefix matching without a trailing separator
• commonpath does not normalize ..
• Userinfo tricks in SSRF allow-lists
• Decimal (integer) IP notation
• Normalising alternate IP encodings
• Validator vs. resolver disagreement
• IPv6 hosts in URLs
• Protocol-relative redirects
• Ranges a deny-list must cover
• Multiple '@' in the authority
• Short numeric hosts normalise to IPv4
• Range checks with the inet type
• Basic auth header encoding
• HOTP dynamic truncation
• Length of a URL-safe token
• Default PBKDF2 output length
• Reading a JWT header
• Length of an md5 password verifier
• TOTP time step counter
• JWT payload segments are only base64url-encoded
• Composing a login eligibility predicate
• Session cookie attributes
• Session fixation
• Verifying signed session cookies
• Idle versus absolute session timeouts
• Counting usable sessions
• Expiring a session cookie
• Cookie domain scope
• The __Host- cookie prefix
• Sliding session expiry in SQL
• Cookie path matching
• umask narrows requested permissions
• Deny-overrides combining rule
• Permission bitmasks union across roles
• Transitive role inheritance in RBAC
• Ownership plus group membership filtering
• Type mismatches in ownership checks
• Wildcard scope matching pitfalls
• Rule order in first-match ACLs
• Deny-overrides rule combining
• JSON round-trips lose Python types
• Filtering fields with a JSON.parse reviver
• Checking parsed JSON types in PostgreSQL
• jsonb normalises documents on parse
• Allow-listing type tags during decoding
• Integer precision loss when parsing JSON
• pickle __reduce__ controls reconstruction
• JSON.parse keeps __proto__ as an own key
• jsonb parsing drops duplicate keys
• Base64 length of a SHA-256 HMAC
• PBKDF2-HMAC-SHA1 test vector
• Digest width of built-in sha256 in PostgreSQL
• XOR is its own inverse
• HMAC key pre-hashing collapses long keys
• PKCS#7 padding on an exact block boundary
• Digest comparison is byte-exact
• Entropy of secrets.token_hex(n)
• Two-time pad: XOR cancels a reused keystream
• HMAC pre-hashes keys longer than the block size
• str.isdigit accepts non-ASCII digits
• Number() coerces far more than decimal digits
• Python $ matches before a trailing newline
• NFKC normalization can recreate dangerous characters
• Character length differs from byte length
• The in operator walks the prototype chain
• bool is a subclass of int in Python
• $ matches before a trailing newline
• Number() parses exponent notation
• Bound parameters compare as plain values
• quote_ident protects identifiers
• Placeholders bind values, not identifiers
• Normalizing traversal payloads
• Lockout counting: sliding window plus streak reset
• Transitive group permission inheritance
• Restricted unpickling and find_class
• isdigit() accepts non-ASCII digits