Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Java web application allows users to submit comments that are later displayed to other users. The development team wants to prevent cross-site scripting (XSS) attacks while preserving the ability to display basic text formatting. Which filtering technique should be applied at the point where the comment is rendered?

   • AStore the input as base64-encoded text and decode it when displaying.
   • BRemove all HTML tags from the input before storing it.
   • CUse a blacklist to remove script tags and event handlers from the input.
   • DEncode the output using a context-aware encoder such as OWASP Java Encoder.
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A Java application accepts a 'countryCode' parameter that must be a two-letter ISO code. The team is evaluating validation frameworks. Which approach is most appropriate?

   • AUse no validation because the field is only used for display purposes.
   • BUse client-side JavaScript to check the length of the input.
   • CUse a blacklist that rejects any input containing digits or symbols.
   • DUse a validation framework like Hibernate Validator with a @Pattern annotation that matches ^[A-Z]{2}$.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which filtering technique is used to prevent SQL injection by converting special characters in user input into their HTML entity equivalents?

   • AValidating against a whitelist
   • BEncoding dangerous characters
   • CCanonicalizing input
   • DRemoving dangerous characters
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A Java application accepts a 'zipCode' field for US addresses. The team is deciding between whitelist and blacklist validation. Which statement correctly guides their decision?

   • AUse no validation because the field is only used for shipping labels.
   • BUse whitelist validation with a regex like ^\d{5}(-\d{4})?$ to accept only valid US ZIP code formats.
   • CUse blacklist validation to reject any input containing letters.
   • DUse blacklist validation to reject common SQL injection characters like ' and ;.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team is building a Java web application that accepts a 'search' parameter and displays it back to the user. They want to prevent stored XSS. Which combination of controls provides the most effective defense in depth?

   • AClient-side JavaScript validation and a database CHECK constraint that rejects strings containing '<' or '>'.
   • BServer-side blacklist that removes 'script' and a filter that truncates input to 100 characters.
   • CDatabase stored procedure that encodes all input before storage and a whitelist on the client side.
   • DServer-side whitelist validation, output encoding on the response, and a Content Security Policy (CSP) header.
   Reveal Solution Discussion Select an answer first