Bad actors are there. We need to be very careful with their input.
TL;DR: Sanitize everything that comes from outside your control.
- Security
- Use sanitization and input filtering techniques.
Whenever you get input from an external resource, a security principle requests you to validate and check for potentially harmful inputs.
SQL Injection is a notable example of a threat.
We can also add assertions and invariants to our inputs.
Even better, we can work with Domain Restricted Objects.
user_input = "abc123!@#"
# This content might not be very safe
# if you expect just alphanumeric charactersdef sanitize(string):
# Remove any characters that are not letters or numbers
sanitized_string = re.sub(r'[^a-zA-Z0-9]', '', string)
return sanitized_string
user_input = "abc123!@#"
print(sanitize(user_input)) # Output: "abc123"[X] Semi-Automatic
We can statically check all the inputs and also we can also use penetration testing tools.
- Security
We need to be very cautious with the inputs beyond our control.
Code Smell 121 - String Validations
Code Smell 178 - Subsets Violation
Code Smell 15 - Missed Preconditions
Code Smell 207 - Dynamic Methods
Code Smell 215 - Deserializing Object Vulnerability
Code Smells are just my opinion.
Photo by Jess Zoerb on Unsplash
Companies should make their own enterprise systems as often as network security companies should manufacture their own aspirin.
Phil Simon
Software Engineering Great Quotes
This article is part of the CodeSmell Series.