Code Explainers

Code explainers tagged #security

typescript 
import { Exclude, Expose, Transform, Type } from 'class-transformer';
 
export class AddressEntity {
  street: string;

Shaping API responses with class-transformer in NestJS

serialization decorators dto
Intermediate 10 steps
javascript 
const express = require('express');
const cookieParser = require('cookie-parser');
 
const router = express.Router();

Remember-me login with signed cookies in Express

authentication signed-cookies sessions
Intermediate 9 steps
javascript 
const express = require('express');
const multer = require('multer');
const path = require('path');
const crypto = require('crypto');

Safe image uploads with Multer in Express

file-upload multer validation
Intermediate 7 steps
python 
from starlette.middleware.base import BaseHTTPMiddleware
from starlette.requests import Request
from starlette.responses import JSONResponse, Response
from starlette.status import HTTP_413_REQUEST_ENTITY_TOO_LARGE

Enforcing a max request body size in FastAPI

middleware streaming request-limits
Advanced 6 steps
java 
@Controller
@RequestMapping("/employees")
public class EmployeeController {
 

Customizing form binding in a Spring MVC controller

data-binding validation type-conversion
Intermediate 9 steps
go 
package middleware
 
import (
	"errors"

Capping request body size in Gin

middleware request limits error handling
Intermediate 5 steps
javascript 
function escapeHtml(str) {
  return str.replace(/[&<>"']/g, (ch) => ({
    '&': '&amp;',
    '<': '&lt;',

Safely highlighting search matches in text

html-escaping regex search-highlighting
Intermediate 7 steps
go 
package auth
 
import (
	"errors"

Hashing and verifying passwords with bcrypt in Go

password-hashing bcrypt error-handling
Intermediate 7 steps
go 
package auth
 
import (
	"net/http"

Setting and reading secure session cookies in Go

cookies session-management security
Intermediate 6 steps
ruby 
class PasswordResetsController < ApplicationController
  RESET_PURPOSE = :password_reset
  RESET_EXPIRY = 15.minutes
 

Password resets with signed global IDs in Rails

authentication signed-tokens global-id
Intermediate 9 steps
python 
import os
import tarfile
from pathlib import Path
 

Safely compressing and extracting tar.gz archives

file-io compression path-traversal
Intermediate 6 steps
java 
public final class ZipExtractor {
 
    private final Path targetDir;
 

Extracting a zip safely in Java

path-traversal streams file-io
Intermediate 8 steps
python 
import logging
import re
 
 

Redacting secrets in Python log records

logging regex redaction
Intermediate 7 steps
java 
@RestController
@RequestMapping("/api/documents")
@RequiredArgsConstructor
public class DocumentController {

Method-level authorization with @PreAuthorize in Spring

authorization spel rest-api
Intermediate 7 steps
php 
<?php
 
namespace App\Services;
 

Phone verification codes in Laravel

rate-limiting caching hashing
Intermediate 7 steps
php 
<?php
 
namespace App\Http\Middleware;
 

Verifying webhook signatures in Laravel

hmac middleware webhooks
Intermediate 7 steps
javascript 
const ESCAPE_MAP = {
  '&': '&amp;',
  '<': '&lt;',
  '>': '&gt;',

Escaping HTML before injecting user content

xss-prevention escaping dom
Intermediate 6 steps
java 
@Target(ElementType.PARAMETER)
@Retention(RetentionPolicy.RUNTIME)
public @interface CurrentUser {
}

Injecting the current user in Spring MVC

annotations dependency-injection security
Intermediate 8 steps