Step 3 / Select topic Backend Security Medium

What this bank covers

• Bind parameters treat payloads as plain data
• Operator precedence can defeat a naive tautology
• Comment injection removes the password check
• UNION injection must match the column count
• Quote stripping does not protect numeric contexts
• Escaping a quote by doubling it
• Parameters cannot replace identifiers
• Parameters stop SQL injection, not wildcard abuse
• Blacklist stripping can reassemble the keyword
• LIMIT 1 is not a defense
• Quoted arguments stay as one token
• Which characters count as unsafe
• Quoting the empty string
• Argument arrays do not split on spaces
• Reducing a path to its final component
• Quoting a value containing a single quote
• Anchored allowlist patterns reject shell metacharacters
• shlex.quote wraps values in single quotes
• Denylists miss the metacharacters they forgot
• An allowlist filter changes anything outside its character set
• os.path.join and absolute segments
• normpath keeps leading dot-dot
• Single-pass filters can create traversal
• Percent-encoded separators
• String prefix checks are not containment checks
• basename strips every directory component
• Backslash is not a POSIX separator
• Rejecting dot-dot and absolute paths
• Double-encoded traversal
• os.path.join discards the base on an absolute component
• Userinfo tricks in SSRF allowlists
• Prefix checks are not host checks
• Decimal-encoded loopback addresses
• is_private covers link-local
• WHATWG URL hostname vs host
• Counting internal targets with is_private
• Scheme allowlists stop gopher/file SSRF
• IPv6 loopback in URLs
• Fragments do not change the host
• WHATWG host parsing rewrites integer hosts
• compare_digest is case sensitive
• JWT structure
• Reading a JWT header
• Unsigned tokens still have three parts
• Length and digit policy
• Per-account attempt counter
• NULL is not the empty string
• Anatomy of a bcrypt hash
• Session cookie hardening
• Basic auth credential splitting
• SameSite and cross-site requests
• Session fixation and id regeneration
• Length of a base64url session token
• Sweeping idle sessions
• Inclusive idle-timeout boundary
• Duplicate cookie names in a Cookie header
• Client-side-only logout
• Regenerating an id without leaving an orphan
• Max-Age is expressed in seconds
• Detecting shared session identifiers
• role permission lookup
• object ownership check
• row level access filter
• deny overrides policy evaluation
• wildcard permission matching
• role hierarchy inheritance
• mass assignment privilege escalation
• any versus all in permission checks
• group based permission resolution
• case sensitivity in role comparison
• JSON loses Python-specific types
• Unpickling builds a new object
• __reduce__ makes unpickling call arbitrary callables
• JSON numbers with exponents decode as floats
• JSON.parse does not honour __proto__
• Recursive merge of parsed JSON pollutes Object.prototype
• ast.literal_eval refuses non-literal nodes
• jsonb parsing drops duplicate keys
• Python's json decoder accepts NaN and Infinity
• Hex digest length of SHA-256
• PBKDF2 output length
• Salts change the derived key
• secrets.token_hex length
• HMAC tags depend on the key
• length() on a bytea digest
• base64url alphabet
• Comparing stored digests
• Password verification is byte-exact
• Keystream reuse leaks the plaintext XOR
• re.match only anchors the start
• int() tolerates whitespace and underscores
• Number() understands non-decimal literals
• Anchored POSIX regex in Postgres
• isdigit covers more than ASCII 0-9
• parseInt stops at the first invalid character
• Postgres trims whitespace on integer input
• int() accepts underscore digit separators
• Number() parses hex, octal and binary prefixes
• Pickle runs __reduce__ callables on load
• Anchored regex still lets a trailing newline through