Secure coding fundamentals
Two small Python builds that show security thinking, not just working code
Problem
The naive version of each is a security hole. A quick calculator reaches for eval(), a remote-code-execution hole. A game writes a plain-text score file anyone can edit. The exercise was to build the correct version of each, and prove it with tests.
Good security engineers can build the code they defend. These two Secure Coding (CSEC1003D) projects apply that mindset to everyday programs: assume input is hostile, and protect integrity even where nobody thinks to.
What I did
The calculator is a hand-written tokeniser + shunting-yard parser + fixed-operation evaluator, structurally incapable of running arbitrary code. The card game (War) uses clean OOP (Card / Deck / Player / engine) and signs every recorded result with HMAC-SHA256, so any edit to the score log is detected.
Safe expression calculator
The common “quick calculator”, eval(user_input), is a remote-code-execution hole. This one classifies every character explicitly and only ever performs a closed set of maths operations, so hostile input is rejected before any computation.
- Three stages: tokeniser → shunting-yard parser → RPN evaluator (no eval anywhere)
- Rejects code injection and illegal characters at the lexer
- Guards division-by-zero, domain errors and exponent-based DoS
Object-oriented War, with integrity
A clean OOP implementation (immutable cards, seedable deck, players, rules engine), plus a security twist: every game result is appended to an HMAC-SHA256-signed log, and verification uses a constant-time comparison, so tampering with the score file is detected.
Tested and honest
29 unit tests across the two projects, including dedicated security suites (code-injection rejection, input-length and exponent guards, tamper detection, wrong-key verification). Both are on GitHub as secure-calculator and card-war.
Evidence
- Uses of eval()
- 0
- checked by searching the repo source
- Unit tests
- 29
- 14 calculator + 15 card game · unittest, in the repos
- Tamper-evident scores
- HMAC
- SHA-256 signed log
- Focused builds
- 2
- calculator · card game
Stack and tools
Result
Two small, tested projects that show secure-by-default habits in everyday code, with the tests in the public repos.