Add multilingual language and systems learning tracks

en/expanded-28-1/README.md

@@ -0,0 +1,9 @@
+# Secure Software & Testing · 1
+
+[Agila University track](https://edu.agilaos.com/track.php?track=28&lang=en)
+
+About 15 minutes per lesson. Predict, run, change, explain, then complete the check in University.
+
+- [Lesson 1: Validate before crossing a boundary](lesson-1/lesson.html)
+- [Lesson 2: Separate data from instructions](lesson-2/lesson.html)
+- [Lesson 3: Regression tests must challenge the fix](lesson-3/lesson.html)

en/expanded-28-1/lesson-1/lesson.html

@@ -0,0 +1,4 @@
+<!doctype html><html lang="en"><meta charset="utf-8"><title>Validate before crossing a boundary</title><h1>Validate before crossing a boundary</h1><p>15-minute session: read for 3 minutes, trace for 3, experiment for 7, and complete the check for 2. Spend longer whenever you need.</p><p>Treat external values as untrusted. Define valid type, size, range, and structure before use. Reject an invalid value with a clear error instead of silently turning it into a different request. Test both endpoints and the values immediately outside them. A validated value still needs authorization for the requested action.</p><p><strong>Practice and evidence:</strong> Predict the example or draw its state transitions. Change one assumption, test the boundary, and record the actual result. Explain what this small model does not establish about a production system.</p><pre><code class="language-python">def valid_score(value):
+    return type(value) is int and 0&lt;=value&lt;=100
+print([valid_score(x) for x in [-1,0,100,101,True]])
+</code></pre><p><strong>Expected result:</strong> <code>[False, True, True, False, False]</code></p><h3>Practice and evidence</h3><p>Keep three notes: your prediction, the actual result, and why they match or differ. The completion check grades understanding; the practice task builds skill.</p></html>

en/expanded-28-1/lesson-1/main.py

@@ -0,0 +1,3 @@
+def valid_score(value):
+    return type(value) is int and 0<=value<=100
+print([valid_score(x) for x in [-1,0,100,101,True]])

en/expanded-28-1/lesson-2/lesson.html

@@ -0,0 +1,7 @@
+<!doctype html><html lang="en"><meta charset="utf-8"><title>Separate data from instructions</title><h1>Separate data from instructions</h1><p>15-minute session: read for 3 minutes, trace for 3, experiment for 7, and complete the check for 2. Spend longer whenever you need.</p><p>Use parameterized queries for database values and argument arrays for process invocation. Escaping for HTML does not make a string safe for SQL or a shell. Identify the interpreter at each boundary and use the interface designed for data. This lesson does not require executing attack payloads against another service.</p><p><strong>Practice and evidence:</strong> Predict the example or draw its state transitions. Change one assumption, test the boundary, and record the actual result. Explain what this small model does not establish about a production system.</p><pre><code class="language-python">import sqlite3
+db=sqlite3.connect(&quot;:memory:&quot;)
+db.execute(&quot;create table notes(value text)&quot;)
+value=&quot;A student&#x27;s note&quot;
+db.execute(&quot;insert into notes values (?)&quot;,(value,))
+print(db.execute(&quot;select value from notes&quot;).fetchone()[0])
+</code></pre><p><strong>Expected result:</strong> <code>A student&#x27;s note</code></p><h3>Practice and evidence</h3><p>Keep three notes: your prediction, the actual result, and why they match or differ. The completion check grades understanding; the practice task builds skill.</p></html>

en/expanded-28-1/lesson-2/main.py

@@ -0,0 +1,6 @@
+import sqlite3
+db=sqlite3.connect(":memory:")
+db.execute("create table notes(value text)")
+value="A student's note"
+db.execute("insert into notes values (?)",(value,))
+print(db.execute("select value from notes").fetchone()[0])

en/expanded-28-1/lesson-3/lesson.html

@@ -0,0 +1 @@
+<!doctype html><html lang="en"><meta charset="utf-8"><title>Regression tests must challenge the fix</title><h1>Regression tests must challenge the fix</h1><p>15-minute session: read for 3 minutes, trace for 3, experiment for 7, and complete the check for 2. Spend longer whenever you need.</p><p>Write a test that fails before a bug fix and passes afterward. Include the smallest input that reproduces the issue and a neighboring valid case. Keep authorization, boundary, and error-path tests; a happy-path screenshot is not sufficient. Document what your test cannot prove and avoid claiming absence of all vulnerabilities.</p><p><strong>Practice and evidence:</strong> Predict the example or draw its state transitions. Change one assumption, test the boundary, and record the actual result. Explain what this small model does not establish about a production system.</p><h3>Practice and evidence</h3><p>Keep three notes: your prediction, the actual result, and why they match or differ. The completion check grades understanding; the practice task builds skill.</p></html>