All learning paths Learn See Try Make Spot unsafe code in an answer What this lesson is about Find the answer that works and still should not be used. It deletes, it leaks, or it trusts any input.
A submitted program cleans up the upload folder on your office server, and every test it came with passed. What now?
A Run it on sample files, see the folder cleaned, and mark the answer correct. B Mark it correct now and add a warning note for whoever puts it on the real server. C Refuse three shapes: it deletes without asking, it sends data out, it runs any input.
Check my recall Why this matters Correct and safe are two different questions, and tests only answer the first. An answer can pass everything and still delete a folder, send a file outside, or run whatever a user typed. Saying so is the sentence a reviewer is paid for.
Name the line that makes a working answer unsafe, and write the safer line in its place.
Correct and safe are two different questions, and tests only answer the first. An answer can pass everything and still delete a folder, send a file outside, or run whatever a user typed. Saying so is the sentence a reviewer is paid for.
Refuse three shapes: it deletes without asking, it sends data out, it runs any input. An API key, a password or a personal detail written into the code is a failure. Say what it would cost if this ran on real data, because that is the review. Task Review an answer that cleans up an upload folder on a small office server.
Weak approach Runs it on the sample files, reads every line, and marks the answer correct because the folder came out clean. The file names in that sample were all his own.
Stronger approach Names line 14, where the file name goes into a shell command. Says a name carrying a semicolon would run anything after it.
Why the stronger approach works Both answers agree the code works. Only one says what it would do on a file somebody else named.
Try a changed situation A colleague shares a notebook that works. On line two his own key is typed in as plain text. He says it is only for testing. What do you write?
Make something yourself Find one answer that runs and is still unsafe. Write the exact line, what it would do on real data, and the safer line to put there.
Lesson 8 of 10 on Coding for evaluation work next Make one contribution to a project Part 3 ends in a work sample you can send
Read the primary or official source: Python documentation · subprocess security