In the Python ecosystem, there are three popular template render engines: Django's built-in template engine, Jinja2 and Mako.
How good are these render engines against XSS. Is {{ foo }} enough? Under what sitations do {{ foo }}
fail? The importance of this research is to understand (1) the context-awareness of template engine, if at all,
(2) understand the challenge of encoding in the HTML world, and (3) and best practices when using template
render engine.
Live demo: http://sqlfiddle.com/#!2/8cd47/23
Oh I heard you like SQL injection so here is a mini guide just so I don't have to google again or remind myself whatever the fuck I am reading.
CREATE TABLE users (
id int,
| http://docs.oracle.com/javase/tutorial/java/ | |
| Books: | |
| 1. http://introcs.cs.princeton.edu/java/home/ | |
| 2. http://greenteapress.com/thinkapjava/thinkapjava.pdf | |
| MIT: http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-092-introduction-to-programming-in-java-january-iap-2010/ |
| First time | |
| hg pull -u | |
| hg qnew bug1.patch | |
| Next week, refresh latest before submitting my patch to bugzilla | |
| hg qpop -a | |
| hg pull -u | |
| hg qpush <the patch i want> |
| const { Task } = Cu.import("resource://gre/modules/Task.jsm", {}); | |
| const { defer, all } = require("sdk/core/promise"); | |
| const { setTimeout } = require("sdk/timers"); | |
| Task.spawn(function * () { | |
| let item1 = yield getItem(1); | |
| let [item2, item3] = all([getItem(2), getItem(3)]); | |
| console.log(item1, item2, item3); // 1, 2, 3 | |
| }).then(function () { | |
| console.log('all items processed') |
| Definitely take | |
| 1. Software engineering | |
| 2. Database | |
| Elective courses: | |
| Category A: | |
| - AI | |
| - Computer Security |
| import unittest | |
| def find_local_min(A): | |
| if len(A) == 0: | |
| return None | |
| elif len(A) == 1: | |
| return A[0] | |
| else: | |
| if A[0] < A[1]: | |
| return A[0] |
Modern applications usually make use of back-end API servers to provide their services. With a non-transparent HTTPs proxy, which intercepts the communication between clients and servers (aka the man-in-the-middle scheme), you can easily manipulate both API requests and responses.
This manual helps you create your own proxy with Python and mitmproxy/libmproxy. Mitmproxy ships with both a standalone command-line tool (mitmproxy) and a Python library (libmproxy).
| [plugin] | |
| ; output directory (if input /home/user, output to /home/user/{plugin_package_name}) | |
| location: ? | |
| ; plugin name: ZAP, Django Security, O-SAFT | |
| plugin_name: ? | |
| ; plugin package name: minion-zap-plugin, minion-django-security-plugin, minion-osaft-plugin | |
| plugin_package_name: minion-?-plugin |
| { | |
| "options": { | |
| "osShell": false, | |
| "getUsers": false, | |
| "getPasswordHashes": false, | |
| "excludeSysDbs": false, | |
| "uChar": null, | |
| "regData": null, | |
| "cDel": null, | |
| "cpuThrottle": 5, |