Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A Java application accepts a 'role' parameter from a request to determine the user's permissions. The application currently uses a blacklist to reject roles like 'admin' or 'root'. An attacker was able to escalate privileges by sending the role as 'a%64min' (URL-encoded). What is the most effective fix?

   • AUse a blacklist that also includes URL-encoded variants of 'admin'.
   • BRemove all non-alphanumeric characters from the input before comparing.
   • CCanonicalize the input (decode URL encoding) and then use a whitelist of allowed roles.
   • DEncode the input using HTML entity encoding before comparing it to the blacklist.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Java web application has a search feature that accepts a query and uses it in a SQL LIKE clause. The application uses a validation framework that checks the length and character set of the input. However, the security team wants to also prevent wildcard injection (e.g., using '%' or '_' to match all records). What is the best way to handle this?

   • AUse a whitelist that allows only alphanumeric characters.
   • BEscape the LIKE wildcard characters in the input before using it in the query.
   • CUse a blacklist to remove '%' and '_' from the input.
   • DCanonicalize the input to uppercase before using it in the query.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In which scenario is blacklist validation more practical than whitelist validation?

   • AWhen the application requires strict validation of all input fields.
   • BWhen the input is free-form text and the goal is to block a few specific dangerous patterns.
   • CWhen the input must conform to a regular expression that defines allowed characters.
   • DWhen the set of valid inputs is small and well-defined, such as a list of state abbreviations.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the purpose of canonicalization in input validation?

   • ATo convert input into a standard, unambiguous form
   • BTo remove all special characters from user input
   • CTo log all user input for auditing
   • DTo encrypt user input before storing it
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A Java web application has a form that accepts a date of birth. The front-end uses a date picker that sends the date in the format 'yyyy-MM-dd'. The server-side code parses the date using SimpleDateFormat. The security team wants to ensure that the date is valid and not just a string that matches the pattern. What should the developer do?

   • AUse a blacklist to reject dates that contain letters or special characters.
   • BCanonicalize the date string to UTC and then store it as a timestamp.
   • CUse a validation framework like Hibernate Validator with @Past and @Pattern annotations on the date field.
   • DTrust the client-side date picker and store the date as a string.
   Reveal Solution Discussion Select an answer first