Check serialization trust, repeated fields, mail headers, local streams and file descriptors.
Review the related lessons
- Python pickle: preserve trusted aliases without decoding received objects
- Python query strings: retain blank fields and reject repeated keys
- Python EmailMessage: keep received newlines out of a header field
- Python email parsing: inspect all sender headers before trusting one
- Python ConfigParser: read literal percent signs without hidden interpolation
- Python socket recv: assemble an exact frame across local socket reads
- Python TextIOWrapper: choose whether input line endings are normalized
- Python POSIX dir_fd and O_NOFOLLOW: reject a final symlink on an owned open
Common Mistakes
Passing a local parser fixture does not establish a network or filesystem security boundary.