Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is it important to implement input validation at multiple layers (client-side, server-side, and database) rather than only at one layer?

   • ATo ensure that validation is not bypassed and to provide defense in depth
   • BTo improve the user experience by providing faster feedback
   • CTo comply with regulatory requirements for data storage
   • DTo reduce the amount of code needed for validation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Java application validates a file path input by checking that it starts with '/safe/'. An attacker submits the path '/safe/../etc/passwd' and the application reads the file. What is the most effective fix?

   • AAdd a blacklist that rejects any path containing '..'.
   • BUse a whitelist of allowed file names instead of validating the path prefix.
   • CCanonicalize the path using Path.normalize() or toRealPath() before validating it.
   • DCheck that the path starts with '/safe/' and contains no null bytes.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A Java application validates a file upload by checking the file extension against a whitelist of '.jpg', '.png', and '.gif'. An attacker uploads a file named 'image.jsp%00.png' and the application stores it as 'image.jsp'. What is the most likely reason the validation was bypassed?

   • AThe application did not canonicalize the file name before validating the extension.
   • BThe application used a blacklist instead of a whitelist for the extension.
   • CThe file name was too long and the extension was truncated.
   • DThe whitelist was too restrictive and did not include '.jsp'.
   Reveal Solution Discussion Select an answer first
5. 24expert · easy

   A Java application accepts a 'role' parameter that must be one of 'admin', 'user', or 'guest'. The team is deciding between whitelist and blacklist validation. Which approach is more appropriate and why?

   • ANeither approach is needed because the role is assigned by the server.
   • BBoth are equally secure because the parameter is only used in a switch statement.
   • CBlacklist validation, because it is easier to maintain when new roles are added.
   • DWhitelist validation, because the set of valid roles is small and fixed.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which filtering approach is most appropriate when the application expects a numeric ID and any non-digit character should be discarded?

   • ABlacklisting known bad strings
   • BCanonicalizing the input
   • CRemoving non-digit characters
   • DEncoding the input
   Reveal Solution Discussion Select an answer first