[ TOPIC ]
security
15 real merged PRs across 12 projects, ordered easiest to hardest. Read them in order to see how security shows up in production code, then go deeper with the free papers and talks below.
[ 01 // REAL PRs ]
Next (mid) · 14
iscsi: prevent plugin directory path traversal
This PR teaches how to defend against path traversal vulnerabilities in filesystem operations by validating user-influenced paths, and demonstrates robust regression testing for security fixes.
sqlite: re-validate database state after reading options
This PR teaches how to defensively re-check resource state after user-supplied code runs, preventing use-after-close bugs and subtle security/memory issues in native bindings.
LDAP: escape DN template values, not full bind values (backport #17278)
This PR teaches how to correctly handle and test escaping of user-supplied values in LDAP distinguished name (DN) templates to avoid security issues and interoperability problems with Active Directory.
gh-155694: Scope HTTPPasswordMgr credentials by URL scheme
This PR teaches how to scope sensitive credentials by URL scheme to prevent credential leakage between HTTP and HTTPS, illustrating secure API design and careful backwards compatibility in a widely used standard library.
LDAP: escape DN template values, not full bind values
This PR teaches how to correctly handle and escape user input in LDAP distinguished name (DN) templates to avoid both security issues and compatibility problems with Active Directory, illustrating the subtleties of input validation and escaping in authentication systems.
Add tls-groups to control TLS named groups
This PR teaches how to safely expose and document low-level TLS configuration (named groups) in a server, handle cross-version OpenSSL compatibility, and add robust tests and documentation for a security-sensitive feature.
Avoid rooting cryptography through ZipArchive on browser
This PR teaches how to conditionally remove a security-related dependency for specific platforms (browser/WASM) to reduce binary size, while maintaining platform-appropriate fallbacks and ensuring that unsupported features fail clearly.
Fix wrong access type for SYSTEM CLEANUP and VIRTUAL PARTS UPDATE ON CLUSTER
This PR teaches how to correctly align privilege checks for distributed SQL commands, ensuring RBAC consistency and writing regression tests for access control changes.
📝 Update `tutorial/security/oauth2-jwt/` to use `pwdlib` with Argon2 instead of `passlib`
This PR teaches how to migrate a Python project's password hashing from an outdated library (passlib/bcrypt) to a modern, secure, and future-proof alternative (pwdlib/Argon2), including code, documentation, and dependency updates.
[X86] Match ENDBR immediates in little-endian order
This PR teaches how to robustly detect and scrub dangerous instruction byte sequences in generated machine code to mitigate security risks from unintended instruction gadgets.
kube-scheduler: redact extender TLS key data from the component config log
This PR teaches how to securely redact sensitive data from logs, ensuring secrets like private keys are not exposed, and demonstrates how to test that redaction is effective and non-mutative.
quic: support P-384 and P-521 EC certificates
This PR teaches how to extend cryptographic support with runtime guards, proper error handling, and thorough testing for new certificate curve support in a network proxy.
Fix NodeRestriction audience authz fallback on volume lookup error
This PR teaches how to handle error fallback logic in authorization checks with detailed testing to ensure security correctness in a Kubernetes admission plugin.
fix: [2.6] enforce partition statistics privilege (#52248)
This PR demonstrates how to enforce and test fine-grained RBAC privileges for API endpoints, including updating tests to verify correct permission handling.
[ 02 // MUST-READ PAPERS ]
Free to read, ranked by citations.
other topics