Tested fixes for the weaknesses API4:2023 maps, in Express, Flask, Spring Boot, ASP.NET Core, Next.js, FastAPI, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a wrong fix and the regression tests.
Every API call costs CPU, memory, bandwidth or money; without limits, one client can cause an outage or a large bill, including through paid third-party services such as SMS or AI APIs.
- Limit payload, page, batch and upload sizes, execution time and memory.
- Rate-limit per client and per operation, with tighter limits on expensive operations.
- Set spending limits and alerts for the third-party services the API calls.
Guides on this site
Bound API work, not just request counts
Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
Apply security limits to GraphQL, WebSocket and gRPC operations
Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.
Bound background jobs and make retries safe
Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
Design a safer file-upload pipeline
Treat upload receipt, content processing, storage, and later delivery as separate security decisions.
Bound agent spending, memory and recovery
Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
Parse bounded JSON and XML into an explicit application schema
Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.
Extract archives without escaping the destination
Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.
Validate input safely and prevent regex denial of service
Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.
Practice
- Path traversal lab: Keep archive entries inside their extraction directory · Browser lab
- Path traversal lab: Serve an uploaded file without path traversal · Browser lab
- File upload lab: Accept avatars without publishing pages · Browser lab
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- Keep extracted files inside their boundary · Local project
- Repair a real proxy and shared cache · Local project
- Parse bounded JSON and XML invoices safely · Local project
- Convert untrusted documents in a locked-down container · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.