Excel
Formula Injection in Excel Exports and How to Stop It
Stop formula injection in xlsx exports: write user text as strings with openpyxl or XlsxWriter, neutralize leading =, +, - and @ characters, and test it.
7 min read
Library
Everything you need to level up your coding skills.
ExcelGuide
Excel Security Problems Developers Overlook in Pipelines
Excel risks a data pipeline inherits: formula injection, macros, zip bombs, XML entity attacks, hidden data and weak passwords, with the checks for each.
17 min read
YAML
Why Loading Untrusted YAML Can Run Code and How to Stop It
How a YAML tag makes a loader build arbitrary objects, with a harmless proof in PyYAML, what safe_load and full_load did with it, and Ruby and Java behavior.
6 min read
YAMLGuide
YAML Security Pitfalls and How to Test Your Own Code
Seven ways YAML hurts: object loading, alias bombs, size, type confusion, duplicate keys, leaked secrets and values used as code, tested in five languages.
17 min read
XML
Sanitizing Data You Put Into an XML Document Safely
User text put into XML by string formatting can add elements and attributes. See the injection, the escaping that stops it, CDATA, bad characters and names.
7 min read
XML
Limiting XML Size and Depth for Uploads With Measured Limits
Where lxml and ElementTree stop on deep nesting, long text nodes and wide documents, what a tree costs in memory, and the limits to set for uploads.
7 min read
XML
XML Signature Wrapping in Plain Language With a Toy Example
Signature wrapping moves a signed element so the signature verifies while the app reads another. A toy HMAC example shows the gap and the fix.
6 min read
XML
Safe XML Handling in PHP and Node for Untrusted Input
Parse untrusted XML in PHP 8.5 and Node 24: why LIBXML_NOENT is the dangerous flag, what DOMDocument does, and how two Node parsers behave.
6 min read
XML
Disabling DTDs and External Entities in Java and Python
Parser settings that stop XXE in Java and Python, tested on one file: which Java features block it, what each error says, and the lxml options.
7 min read
XML
Stopping the Billion Laughs Attack in Your XML Parser
A 547-byte file that expands to 30 million characters. How lxml, ElementTree and Java refused it, what the limits are, and the settings that keep them on.
6 min read
XML
What an XML External Entity Attack Is and Where It Works
An XXE attack makes a parser read a file or fetch a URL the sender names. Run on five parsers, three leaked a local file by default or with one flag.
7 min read
XMLGuide
XML Security Problems to Close Before Production Launch
The XML attacks that matter for web services and loaders, how six parsers behave, one parse function with limits, and the tests that keep it closed.
18 min read
Get new articles by email
We send one email when a new article is published. No spam.