Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A Java application has a search feature that accepts a 'q' parameter. The team implemented a blacklist that removes the string 'script' (case-insensitive) and then URL-decodes the input. A tester submits 'scr%2569pt' and the XSS payload executes. What is the most likely reason?

   • AThe filter used a case-insensitive match, which allowed the payload to pass.
   • BThe filter applied the blacklist before URL-decoding, so it missed the encoded form.
   • CThe input was double-encoded, and the filter only decoded once before applying the blacklist.
   • DThe filter did not canonicalize the input to Unicode normalization form.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Java web application receives a username from a login form. The username is used in a security check that compares it to a list of blocked users. An attacker tried to bypass the block by using the Unicode character 'Ｕ' (fullwidth U) instead of a regular 'U'. What should the developer do to prevent this bypass?

   • AEncode the username using URL encoding before comparing.
   • BUse a blacklist to remove all non-ASCII characters from the username.
   • CUse a whitelist that allows only ASCII letters and digits.
   • DCanonicalize the username to a normalized Unicode form (e.g., NFKC) before performing the comparison.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which input validation strategy is based on defining a set of allowed patterns and rejecting any input that does not match?

   • ABlacklisting
   • BEncoding
   • CWhitelisting
   • DCanonicalization
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A Java application accepts a 'message' field that is stored in a database and later displayed in a mobile app as plain text. The team is debating whether to sanitize the input or encode the output. Which approach is most appropriate?

   • ASanitize the input by removing all HTML tags before storing it.
   • BEncode the output when displaying the message in the mobile app, because the data is rendered as plain text.
   • CDo nothing because the mobile app is not a web browser and cannot execute HTML.
   • DUse a blacklist to remove dangerous characters like <, >, and & from the input.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A Java application has a file upload feature that stores files in a directory based on a user-supplied category. The category is used to construct the file path (e.g., /uploads/{category}/file.txt). The security team found that an attacker can use a category like '..%2f..%2fetc' to write files outside the uploads directory. The team also needs to support categories with spaces and hyphens. What is the best approach?

   • AUse a blacklist to remove '..' and '/' from the category.
   • BUse a whitelist that allows only letters and digits for the category.
   • CEncode the category using URL encoding before constructing the path.
   • DCanonicalize the category path and then validate that the resolved path is within the uploads directory.
   Reveal Solution Discussion Select an answer first