Code Explainers

Code explainers tagged #input-validation

go 
package middleware
 
import (
	"net/http"

Per-plan export limits in Gin middleware

middleware rate-limiting authorization
Intermediate 7 steps
go 
package api
 
import (
	"encoding/json"

Safely decoding JSON in a Go HTTP handler

http json-decoding input-validation
Intermediate 8 steps
typescript 
type CompactOptions = {
  locale?: string;
  maximumFractionDigits?: number;
};

Caching Intl.NumberFormat for compact numbers

memoization internationalization caching
Intermediate 7 steps
python 
from flask import Blueprint, request, jsonify, abort
from sqlalchemy import update
 
from .models import db, Document

Optimistic locking in a Flask PATCH endpoint

optimistic-locking concurrency rest-api
Intermediate 7 steps
go 
func ServeThumbnail(c *gin.Context) {
	raw := c.Param("token")
	sig := c.Query("sig")
 

A signed thumbnail endpoint in Gin

signed-urls image-processing http-handler
Intermediate 9 steps
go 
type Warning struct {
	Field   string `json:"field"`
	Code    string `json:"code"`
	Message string `json:"message"`

Partial-success responses in Gin

error-handling input-validation http-status
Intermediate 8 steps
java 
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
 

Rendering ${} templates with regex in Java

regex string-templating matcher-api
Intermediate 8 steps
typescript 
export interface FormatBytesOptions {
  decimals?: number;
  binary?: boolean;
}

Formatting byte counts into human-readable sizes

formatting logarithms default-parameters
Intermediate 8 steps
go 
package storage
 
import (
	"errors"

Preventing path traversal in Go

path-traversal input-validation security
Intermediate 9 steps
typescript 
export function isValidCardNumber(input: string): boolean {
  const digits = input.replace(/[\s-]/g, "");
 
  if (!/^\d{12,19}$/.test(digits)) {

Validating card numbers with the Luhn check

luhn-algorithm checksum input-validation
Intermediate 7 steps
javascript 
const MAX_FILE_SIZE = 5 * 1024 * 1024;
 
const ALLOWED_TYPES = {
  'image/jpeg': ['jpg', 'jpeg'],

Validating file uploads by content, not just claims

input-validation security magic-bytes
Intermediate 7 steps
ruby 
class ApplicationController < ActionController::Base
  ALLOWED_REDIRECT_HOSTS = [nil, ENV.fetch("APP_HOST", "app.example.com")].freeze
 
  def store_return_to(location = request.fullpath)

Safe post-login redirects in Rails

open-redirect session authentication
Intermediate 9 steps
php 
final class FieldEncryptor
{
    private string $key;
 

Authenticated field encryption with libsodium

encryption libsodium authenticated-encryption
Intermediate 7 steps
go 
func UploadChunk(c *gin.Context) {
	uploadID := c.Param("uploadID")
	if !validUploadID.MatchString(uploadID) {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid upload id"})

Resumable chunked uploads in Gin

file-upload content-range streaming
Advanced 9 steps
go 
package handlers
 
import (
	"encoding/json"

Parsing search query params in a Go handler

http-handlers input-validation defaults
Intermediate 7 steps
go 
func ListProducts(c *gin.Context) {
	allowed := map[string]string{
		"category": "category",
		"brand":    "brand",

Safe query filtering in a Gin handler

input-validation whitelisting query-building
Intermediate 7 steps
ruby 
class SearchController < ApplicationController
  def index
    @query = params[:q].to_s.strip
  end

Live search suggestions in a Rails controller

controllers sql-injection query-building
Intermediate 6 steps
typescript 
import sanitizeHtml from "sanitize-html";
 
interface RichTextOptions {
  allowImages?: boolean;

Building a configurable HTML sanitizer allowlist

sanitization xss-prevention allowlist
Intermediate 7 steps