Secure code review by language: PHP, Python and JavaScript
You recognise dangerous patterns specific to PHP, Python and Node.js and the traps of popular frameworks, find and fix flaws in each language through pull requests, and write Semgrep rules for these languages.
Level 401 · 16 lessons · 14 practice labs
Lessons
PHP
- Dangerous PHP functions: eval, include, unserialize and system
- Type juggling: loose comparison and authentication
- Safe and unsafe patterns in Laravel and Symfony
- Short task: find and fix four flaws in a PHP app
Python
- Dangerous Python patterns: eval, pickle, subprocess and yaml.load
- Safe defaults in Django and protections that get bypassed
- Flask and FastAPI: template, session and validation mistakes
- Short task: find and fix four flaws in a Flask app
JavaScript and Node.js
- Dangerous Node.js patterns: child_process, eval and dynamic require
- Express middleware: ordering mistakes and missing checks
- Prototype pollution and regular-expression denial of service (ReDoS)
- Reviewing front-end code: React, Vue and browser APIs
- Short task: find and fix four flaws in an Express app
Rules and process
- Writing Semgrep rules specific to these languages
- Auditing composer, pip and npm dependencies
- Capstone: review microservices written in three languages and fix them through pull requests
Practice labs
- Loose comparison in PHP: Find the line that uses loose comparison in token verification and fix it with a constant-time strict comparison.
- A dynamic file through include: Find the include call that builds a path from user input and replace it with a fixed map.
- Mass assignment and raw queries in Laravel: Find the unguarded model fields and the raw query in the Laravel service, fix them and pass the tests.
- Four flaws in a PHP service: Find four flaws in the PHP service by reading the code, fix them and add a test for each.
- yaml.load and the safe loader: Find the unsafe yaml.load call in config-reading code and replace it with the safe loader.
- A fixed secret key in Flask: Find the session key embedded in code, fix it to be read from the environment and invalidate old sessions.
- A bypassed protection in Django: Find two places that disable CSRF protection and auto-escaping and restore the protections.
- A missing validation model in FastAPI: Find the endpoint that accepts a raw dict, add a validation model and reject extra fields.
- Four flaws in a Flask service: Find the template, session, command and authorisation flaws in the Flask service, fix them and pass the tests.
- Middleware order in Express: Find the route defined before the authorisation middleware and fix the order.
- A command through child_process: Find code that runs user input through exec and change it to an argument-list call.
- ReDoS: catastrophic backtracking: Measure in the lab that a validation regex locks the service on long input and rewrite the expression.
- Semgrep rules for three languages: Write a Semgrep rule that catches one dangerous pattern each for PHP, Python and Node and run them on the repo.
- Dependency audit: composer, pip, npm: Audit the dependencies of three services, identify the flaw that is really reachable, upgrade and pass the tests.
About this course
You recognise dangerous patterns specific to PHP, Python and Node.js and the traps of popular frameworks, find and fix flaws in each language through pull requests, and write Semgrep rules for these languages.
What you will learn
- PHP
- Python
- JavaScript and Node.js
- Rules and process
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.