1 min lesson

Pick one input-handling problem

For each case in "Pick one input-handling problem", name the signal and the response you would use.

Pick one input-handling problemDrill scope

Parse / validate

Validate an untrusted JSON config against an explicit schema, rejecting unknown keys.

Bound recursion depth and array length so a hostile payload can't blow the stack.

Tests: do you fail closed on malformed input instead of best-effort parsing?

Allowlist / SSRF

Given a user-supplied URL, decide whether your service may fetch it.

Block private CIDRs, 0.0.0.0/8, link-local 169.254.0.0/16 and redirects to internal hosts.

Tests: do you resolve and re-check the host after redirects, not just the first URL?

Path / command

Safely resolve a filename inside a sandbox root with no ../ escape.

Build a shell call without string concatenation of user input.

Tests: do you canonicalize then check containment or just blocklist ..?

Narrate the entire time as if an interviewer is on the call. State your approach and its complexity before you type, then call out the threat implication of each decision as you hit it: "I'm allocating the buffer after I've checked the declared length, so a lying length header can't over-allocate."

Learn more

Full explanation

The 45-minute protocol

The 45-minute protocolRun it like the real screen

THE 45-MINUTE PROTOCOL

1/5

Trust boundary · gate: Name where untrusted data enters and what's authoritative. Is the input attacker-controlled, what's the max size, who calls this? Skip this and the whole design is built on the wrong assumption.

diagram: flow

Defining the trust boundary is the gate. Get it wrong and every later step inherits the mistake.

SSRF guard you can defend line by line: resolve, classify, connect to the vetted IP, re-check after redirectts

import net from "node:net";
import dns from "node:dns/promises";

const BLOCKED_V4 = [
  /^0\./, /^10\./, /^127\./, /^169\.254\./, /^192\.168\./,
  /^172\.(1[6-9]|2\d|3[01])\./,
];

async function isPublicHost(host: string): Promise<boolean> {
  // Resolve first: a hostname can point anywhere, including internal IPs.
  // Then connect to this vetted address (or pin the lookup) so a second
  // DNS resolution can't return a different IP than the one you checked.
  const { address } = await dns.lookup(host);
  if (net.isIPv6(address)) return false; // be conservative; vet v6 explicitly
  return !BLOCKED_V4.some((re) => re.test(address));
}

// Caller MUST re-run isPublicHost on every redirect target,
// not just the original URL. The bypass is a 302 to 169.254.169.254.

You will be asked to defend it, so be ready to answer four questions: why resolve DNS before deciding, why re-check on each redirect, why IPv6 is a separate landmine and why the fetch must use the address you vetted. A hostname resolved a second time can answer differently, which is DNS rebinding. If you can't defend a line, you don't actually know it yet.

Pick one input-handling problem

Step 1 of 2