Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which layer of validation is considered the most critical and must never be omitted?

   • AServer-side validation
   • BNetwork-level validation
   • CClient-side validation
   • DDatabase validation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Java web application allows users to upload a profile picture. The application stores the file on the server and later serves it back to other users. The security team is concerned about the risk of serving malicious content (e.g., HTML or JavaScript) disguised as an image. What filtering technique should be applied?

   • ARemove all HTML tags from the file content before storing it.
   • BUse a blacklist to reject files with a .html or .js extension.
   • CValidate the file's magic bytes and content type, and serve the file with a Content-Disposition header that forces download.
   • DEncode the file content using Base64 before storing it.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Java web application has a registration form that collects an email address. The front-end uses JavaScript to check the email format, and the server-side Java code also validates the input. The database layer is a SQL database. Which additional layer should be implemented to ensure defense in depth?

   • AAdd a database constraint that enforces a valid email format.
   • BEncode the email address using Base64 before storing it in the database.
   • CUse a blacklist to filter out common malicious email patterns.
   • DRemove the client-side validation to avoid user confusion.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Java web application accepts a customer ID in the URL path (e.g., /orders/12345). The ID is used directly in a database query. The security team requires that only numeric IDs be accepted, and the application must reject any other input before it reaches the database layer. Which validation approach should the developer implement?

   • ACanonicalize the input to UTF-8 and then trim whitespace before using it in the query.
   • BUse a whitelist regex that matches only digits and reject anything else.
   • CUse a blacklist to strip common SQL injection characters like quotes and semicolons.
   • DEncode the input using HTML entity encoding before passing it to the database.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Java web application has a legacy module that accepts a 'sortBy' parameter that is directly concatenated into an SQL ORDER BY clause. The valid values are 'name', 'date', and 'price'. The development team wants to fix the SQL injection vulnerability without rewriting the query builder. They also need to support a new sort option 'rating' in the future. What is the best approach?

   • ACanonicalize the input to lowercase and then use it directly in the query.
   • BUse a blacklist to remove SQL keywords like 'ORDER' and 'BY' from the input.
   • CUse a whitelist that maps the allowed sort keys to hardcoded column names.
   • DEncode the input using SQL escaping functions before concatenation.
   Reveal Solution Discussion Select an answer first