
Why a Hostile CSV Upload Can Hurt Your Application Server
A CSV upload needs no exploit to take a server down: compressed bombs, one huge field, an unclosed quote and wide files, each with the limit that stops it.
Everything you need to level up your coding skills.

A CSV upload needs no exploit to take a server down: compressed bombs, one huge field, an unclosed quote and wide files, each with the limit that stops it.

A working guide to loading JSON APIs into a database: raw pages, pagination, rate limits, upserts, cursors, shape checks and retries, with a tested loader.

Merge two people's edits of a CSV against a common base: git merge-file conflicts when both touch a row, merging by key and cell resolves different cells.

Keep a CSV sorted by its key so a one-row change is a one-line diff: sort the body not the header, use byte order and numeric keys, and sort in the writer.

Make git diff readable for a CSV: word diff on commas, a textconv that aligns columns, a sorted file with one record per line and a trailing newline.

Follow a growing CSV with tail -f, skip the header, survive rotation with tail -F and read only complete lines, plus a Python follower and the buffering trap.

A cron export that cannot publish a half-written file: lock, temporary name, row-count check, atomic rename. Real cron failed first, on the environment.

A tested guide to jq 1.8 for slicing JSON in the terminal: filters, streams, CSV, grouping, logs, safe variables, in-place edits and number quirks.

One YAML document parsed in Node, Go, Java, Ruby, PHP, Rust, C# and yq: types, dates, duplicate keys, strict modes, safety and parse speed, all measured.

The extra arguments of JSON.stringify and JSON.parse, tested in Node 24: toJSON, replacer arrays, indent limits, call order and exact numbers.

A tested guide to JSON in JavaScript and Node 24: what stringify drops, parse errors, big numbers, dates, circular data, cloning, files and large inputs.

response.json() raised JSONDecodeError for an empty body, a 204, an HTML 502 and a BOM. Check status first, set a timeout and retry with a Session, as tested.
We send one email when a new article is published. No spam.