1 min lesson

Pick one input-handling problem

For each case in "Pick one input-handling problem", name the signal and the response you would use.

Pick one input-handling problemDrill scope

Parse / validate

Validate an untrusted JSON config against an explicit schema, rejecting unknown keys.

Bound recursion depth and array length so a hostile payload can't blow the stack.

Tests: do you fail closed on malformed input instead of best-effort parsing?

Allowlist / SSRF

Given a user-supplied URL, decide whether your service may fetch it.

Block private CIDRs, link-local 169.254.0.0/16 and redirect-to-internal.

Tests: do you resolve and re-check the host after redirects, not just the first URL?

Path / command

Safely resolve a filename inside a sandbox root with no ../ escape.

Build a shell call without string concatenation of user input.

Tests: do you canonicalize then check containment or just blocklist ..?

Narrate the entire time as if an interviewer is on the call. State your approach and its complexity before you type, then call out the threat implication of each decision as you hit it: “I'm allocating the buffer after I've checked the declared length, so a lying length header can't over-allocate.”

Learn more

Full explanation

The 45-minute protocol

The 45-minute protocolRun it like the real screen

THE 45-MINUTE PROTOCOL

1/5

Trust boundary · gate: Name where untrusted data enters and what's authoritative - is the input attacker-controlled, what's the max size, who calls this. Skip this and the whole design is built on the wrong assumption.

diagram: flow

Defining the trust boundary is the gate - get it wrong and every later step inherits the mistake.

SSRF guard you can defend line by line: resolve, classify, re-check after redirectts

import net from "node:net";
import dns from "node:dns/promises";

const BLOCKED_V4 = [
  /^10\./, /^127\./, /^169\.254\./, /^192\.168\./,
  /^172\.(1[6-9]|2\d|3[01])\./,
];

async function isPublicHost(host: string): Promise<boolean> {
  // Resolve first - a hostname can point anywhere, incl. internal IPs.
  const { address } = await dns.lookup(host);
  if (net.isIPv6(address)) return false; // be conservative; vet v6 explicitly
  return !BLOCKED_V4.some((re) => re.test(address));
}

// Caller MUST re-run isPublicHost on every redirect target,
// not just the original URL - the bypass is a 302 to 169.254.169.254.

Typing it isn't the point. The point is that you can answer: why resolve DNS before deciding, why re-check on each redirect, why IPv6 is a separate landmine. If you can't defend a line, you don't actually know it yet.

Pick one input-handling problem

Step 1 of 2