Skip to content
academia.sh
tr
Log in

Course Intermediate

Secure Coding

Published Updated

By the end of this course

Start course

01

Input and Output Security

Counting the points in the codebase where externally supplied data enters and measuring how far the defense's coverage reaches: the entry point inventory, the point that allowlist-based validation closes on its own, escaping across four output contexts, the identifier position the parameterized query interface cannot cover, user data that reaches a template, file upload inspection layers, outbound request targets that reach the internal network, and the trusted type set in deserialization.

  1. 01 Input Validation Patterns Measuring how many points validation covers: a probe that breaks its own declaration is sent to each of the fifteen field points across the regional measurement network's five entry points, the number of points closed by allowlist-based validation, by the denylist, and by a hand-written check per endpoint is counted, and how coverage changes when a new endpoint and a new field type are added to the inventory is measured.
  2. 02 Output Encoding Measuring the coverage of context-aware escaping: six legitimate subscriber notes are placed into four output contexts with four separate encoders, the placements that cannot be read back across sixteen pairings are counted, in a fourteen-exit-point inventory the form that chooses the encoder at the call site is compared with the form that derives it from the context, and how many values the encoder order breaks in two nested contexts is measured.
  3. 03 Injection Defense Measuring coverage at query points: sixteen query points are run with the same set of values and the number of points where the value reaches the query text is counted, the spot the parameterized query interface closes structurally is separated from why the identifier spot cannot be closed, and the coverage of the strict layer versus the flexible layer is compared when four new queries are added.
  4. 04 Template and Expression Injection Measuring server-side evaluation risk as a surface: the number of names resolvable in the evaluation environment is counted with probes generated from the environment itself, a twelve-template inventory separates how many take user data only as a value versus as an expression, and the total evaluation surface of templates whose body comes from outside is compared across three setups.
  5. 05 File Upload Security Counting the upload flow as a layer of checks: ten upload items pass through five check layers alone and layer by layer, measuring which check alone is not enough and how many unexpected items pass when one is missing, counting the points that a directly addressable storage location opens, and comparing the manual check count against the upload point count as it grows.
  6. 06 Server-Side Request Forgery Passing outbound request targets through a set of constraints: twelve targets are passed through four constraint forms and how many can reach the internal network is counted with real address arithmetic, how many requests a redirect chain delivers to an internal address when the constraint is applied only at the first step is measured, and the point that repeating name resolution between the check and the connection opens is shown.
  7. 07 Insecure Deserialization Measuring deserialization in terms of the trusted type set: type-tagged nodes across six messages are counted at every depth, the type and node count accepted by an explicit type registry is compared with an allowlist, an untagged data format is measured for how far it drives the structure-building point to zero and the mapping point it introduces in exchange, and how the accepted set changes when three new types are added to the codebase is derived.

02

Identity, Session and Authorization Errors

Measuring coverage at the points where identity is established and where it is decided who can do what: the user existence leaked by response-time differences and distinct error messages, the session identifier not being renewed at login and not being invalidated at logout, the number of endpoints that perform only role checks, the paths where step order can be skipped, and how many times the same control is passed by concurrent requests.

  1. 01 Authentication Implementation Errors Measuring the implementation error in terms of leaked information: at eight authentication points, a distinct error message, work skipped when no record exists, and a comparison that exits on the first mismatch are counted as three channels, and five points leak; the response-time difference is shown through a band check rather than by writing the raw duration; a countermeasure that closes only one channel closes just one of the five; a central validator that closes all three channels automatically covers the ninth point added; and when a fourth channel is included in the count, the same pattern's number of uncovered points rises to two.
  2. 02 Session Management Errors Counting session decisions over a flow set: four of seven flows raise the session's authorization level, and two of those are fixation points because they do not renew the identifier; two of three invalidation flows delete no record server-side, so eight sessions continue to live on; a central session pattern brings this number down to two; when an eighth flow is added, the number of flows left uncovered in the distributed setup rises to five; and it is measured that the transfer flow, which never calls the pattern at all, is covered only by a pattern tied to the authorization version.
  3. 03 Broken Access Control Deriving, from the authorization matrix, the number of endpoints with no object-level control: five of fourteen endpoints perform only a role check, fourteen of the seventy-two requests that pass the role check reach someone else's object, a central gate built on default-deny brings this number down to zero while stopping ten legitimate requests, and a fifteenth endpoint added without declaring a criterion raises the distributed check's wrongly-passed count to seventeen while opening no new path at the central gate.
  4. 04 Business Logic Flaws Modeling the business logic flaw as a flow of steps: in a five-step dispute-and-refund flow, five hundred and one of the six hundred and twenty-five four-step paths yield a rule-breaking result under per-step authorization, three hundred sixty-nine make a payment, and one hundred thirteen exceed the quota; a state machine brings these numbers down to zero and the paying path down to one, and when a sixth step with an undeclared transition is added, the rule-breaking path count under per-step setup rises to one thousand one hundred seventy-two while the state machine stays at zero, and as the sequence length grows the share of rule-breaking paths rises from sixty percent to ninety percent.
  5. 05 Race Conditions Measuring how many times the same check passes under concurrent requests: for a single-use quota, sixteen concurrent requests pass sixteen times under the unprotected setup, a lock and a single-writer queue bring this down to the quota, and a retry-less atomic compare-and-update, with a quota of three, lets only one request through and rejects two legitimate requests; four of seven checkpoints are unprotected and produce twenty-seven excess passes under eight concurrent requests, a single-writer queue brings this to zero, and when an eighth checkpoint is added the excess passes rise to thirty-four under the distributed setup.

03

Secrets in Code

The coverage measure for the key, generator, and dependency items the code relies on: how many of the cryptography call points pass through the central layer, the concrete consequence of reusing the same starting value and of having no integrity tag, how much a weak generator gives away in advance once the seed is known, how many commits a secret stays exposed in a fictional repository's history and what history cleanup does not rescue, the portion of the leaked items in error messages and log lines that the central masking layer closes versus leaves exposed, and the transitive depth in the dependency graph along with the number of packages a single component affects.

  1. 01 Cryptographic Misuse The coverage of cryptography call points and the concrete consequence of misuse: how seven of fourteen call points stay uncovered by the central layer, how reusing the same key and the same starting value makes forty positions readable, how the format check in encryption without an integrity tag misses four of twenty-four changes, and how a new call point is covered automatically once the primitive call is confined to a single file.
  2. 02 Randomness A same-scale comparison of the weak generator and the cryptographically secure generator: when the seed is known, all ten thousand values can be precomputed; out of ten thousand four-digit codes, only 903 come out distinct; mapping a byte to a digit by remainder produces a 1.04 bias; and six of the nine token-generation points call the weak generator.
  3. 03 Hardcoded Secrets The number of commits a secret stays exposed in a fictional repository history, and what pattern scanning covers: five secrets appear in 124 commits in the working tree and 223 commits in history, history cleanup fails to reach eighteen of nineteen copies, snapshot scanning sees only one of the five secrets, and the same rule produces a 76.8x increase in findings with a 0.69 false-positive rate over history.
  4. 04 Error Messages and Log Leakage Counting the leakage in an error response and a log line as items: eight endpoints carrying forty item-response pairs in direct mode, the central error handler covering six endpoints and leaving two outside, a top-level name list closing three of eleven log items, the same list run at every level closing eight, format-based masking closing nine, and two items in free text and a query string closing under no list.
  5. 05 Dependency-Related Risks The dependency graph's coverage measure: eight names appear in the manifest file while thirty-four packages exist in the process, the transitive depth rising to six, a single component affecting twenty packages, three of eight direct dependencies never being called, and four of six open findings arriving with the same severity being in reachable components and two being in an unreached component.

Final exam

Secure Coding — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close