Chapter 3 — Programming foundations
Lesson map
Lesson 03 published. Map, example, EX007.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Scripts as tools"]
N2["Lab — Flagging inbound rules open to anywhere"]
N3["3.2 Validating input"]
N4["3.3 Reading code for mistakes"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX007"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Scripts as tools"]
N2["Lab — Flagging inbound rules open to anywhere"]
N3["3.2 Validating input"]
N4["3.3 Reading code for mistakes"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX007"]
[Learning outcomes]
|
v
[3.1 Scripts as tools]
|
v
[Lab — Flagging inbound rules open to anywhere]
|
v
[3.2 Validating input]
|
v
[3.3 Reading code for mistakes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX007]
Learning outcomes
You will (1) write small Python scripts to check configurations; (2) validate input safely; (3) read code for common security mistakes.
3.1 Scripts as tools
Ruth wants technologists who can automate small checks. Tomás writes a Python script that reads the depot's exported firewall rules and lists any rule allowing inbound traffic from anywhere. Writing the check once means it can run after every change instead of relying on someone reading the rules by eye. He keeps the script short, comments each step and tests it on a sample file containing one rule he knows should be flagged. Testing with a known bad case confirms the script actually finds what it claims to find.
Lab — Flagging inbound rules open to anywhere
# Flag inbound firewall rules that allow any source (synthetic export).
rules = [("in", "any", "office-pc3", 3389), ("in", "10.1.0.0/16", "printer2", 9100),
("out", "depot", "any", 443), ("in", "any", "switch1", 22), ("in", "vpn", "office-pc1", 3389)]
flagged = [r for r in rules if r[0] == "in" and r[1] == "any"]
for d, src, dst, port in flagged: print(f"FLAG inbound from {src} to {dst} port {port}")
print(f"{len(flagged)} of {len(rules)} rules flagged")
Run with python3 lab_rules.py. Verified output:
FLAG inbound from any to office-pc3 port 3389
FLAG inbound from any to switch1 port 22
2 of 5 rules flagged
3.2 Validating input
Tomás's next script imports parcel weights from a CSV file sent by a partner. Ruth asks what happens if a line contains text where a number should be, or a negative weight. He adds checks that reject bad lines and report them, instead of crashing or silently storing nonsense. Input validation protects systems from both mistakes and deliberate attacks. He follows the principle of validating against what is allowed, such as numbers between zero and seventy kilograms, rather than trying to list everything that is forbidden.
3.3 Reading code for mistakes
Ruth gives the class short code samples to review. Tomás spots a database query built by joining text with user input, which allows injection; a password written into the source code; and an error message that prints internal details to users. For each he writes the safer pattern: parameterised queries, secrets loaded from a managed store and generic error messages with details logged privately. Reading code for common mistakes is a skill technologists use when reviewing vendor scripts and small internal tools.
Worked example
Tomás writes and tests a rule-checking script, adds allow-list validation to an import and reviews code samples for three common mistakes.
Synthetic case. Rules and code samples are synthetic.
Errors and limits
Small scripts can grow without tests. Allow-lists need updating when business rules change.
Exercises
- EX007 — Known bad case. Why test the script with a rule known to be bad? Rubric: 3 = to confirm it finds what it claims;; 2 = confirmation;; 1 = speed;; 0 = none.
- EX008 — Flagged rules. How many rules did the lab flag? Rubric: 3 = two: 3389 to office-pc3 and 22 to switch1;; 2 = two;; 1 = vague;; 0 = none.
- EX009 — Safer query. What is the safer pattern for database queries with user input? Rubric: 3 = parameterised queries;; 2 = parameters;; 1 = string joining;; 0 = none.
Synthesis
Small, tested scripts and careful code reading let technologists check systems reliably and spot common mistakes.
Continue studying — chapter 03 of 30
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →