Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement correctly differentiates whitelist validation from blacklist validation?

   • AWhitelist validation is used for output encoding, while blacklist validation is used for input validation.
   • BBoth whitelist and blacklist validation are equally secure because they both filter input.
   • CWhitelist validation allows only known good patterns, while blacklist validation rejects known bad patterns.
   • DWhitelist validation rejects known bad patterns, while blacklist validation allows only known good patterns.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A Java application accepts a 'redirectUrl' parameter that is used to redirect users after login. The security team wants to prevent open redirects. They are considering two approaches: (A) whitelist validation that only allows URLs starting with 'https://example.com/', and (B) blacklist validation that rejects URLs containing '//' or 'http:'. Which approach is more secure and why?

   • ABlacklist validation, because it is more flexible and allows any URL that does not contain dangerous patterns.
   • BWhitelist validation, because it only allows URLs that match the trusted prefix and rejects all others.
   • CBoth are equally secure because they both prevent open redirects.
   • DNeither approach is effective; the only solution is to use a URL shortener.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Java application accepts a color preference from a dropdown menu that contains a fixed set of values: red, green, blue. The server-side code currently trusts the client-side selection and stores it in the database. What is the most secure way to validate this input?

   • AEncode the input using HTML entity encoding before storing it.
   • BUse a blacklist to reject any input that contains HTML tags or JavaScript.
   • CUse a whitelist that only accepts the exact strings 'red', 'green', or 'blue'.
   • DCanonicalize the input to lowercase and then accept any string.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Java web application accepts a 'comment' field that is later rendered as HTML. The team wants to sanitize the input to prevent XSS. Which filtering technique is most appropriate?

   • ARemove all occurrences of the string 'script' from the input.
   • BUse a blacklist that removes all angle brackets and quotes.
   • CUse an HTML sanitizer library that parses the input and removes or neutralizes dangerous tags and attributes.
   • DEncode all characters to their HTML entities before storing.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which attack is most likely to succeed if an application fails to canonicalize user input before validation?

   • ACross-site request forgery via missing tokens
   • BSQL injection via encoded characters
   • CSession fixation via predictable session IDs
   • DDenial of service via large payloads
   Reveal Solution Discussion Select an answer first