Skip to lesson
Exit
Application Security & Secure Code Review1 / 2

1 min lesson

Deserialization, path traversal, file handling

Imagine this comes up at work: "A reviewer flags four issues. Which should be fixed first and what's the reasoning a senior security engineer gives?" Start with the practical move.

Step 1 of 2

Deserialization, path traversal, file handlingtrust placed in bytes from outside

  • Insecure deserialization. Feeding attacker bytes to pickle.loads, Java readObject or an unsafe YAML loader can run code during reconstruction. Use data-only formats (JSON) and yaml.safe_load; never deserialize untrusted input into live objects.
  • Path traversal. A filename like ../../etc/passwd escapes the intended directory. Resolve the full path and assert it stays inside the allowed root after normalization - don't just strip .., which a double-encode defeats.
  • File-handling bugs. Trusting a client-supplied content type or extension, serving uploads from the app origin or unzipping without a size cap (zip bombs). Validate by content, store outside the web root, serve from a sandboxed origin.
Interview move

When you flag a finding, prioritize by reachability and impact, not by the scanner's red badge. Say it out loud: "This SQLi is on an authenticated admin-only path, so it's real but lower priority than the SSRF on the unauthenticated webhook endpoint, which an anonymous attacker can hit to steal cloud creds." Reasoning about exploitability is the senior signal; reading a severity label is not.