Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A Java web application has a comment feature. The team wants to prevent stored XSS. They are considering: (1) server-side whitelist validation that only allows letters, digits, and spaces, (2) output encoding when rendering comments, (3) a Content Security Policy (CSP) that disables inline scripts. Which combination provides the most robust defense in depth?

   • AAll three controls: whitelist validation, output encoding, and CSP.
   • BWhitelist validation and output encoding, but not CSP.
   • CWhitelist validation and CSP, but not output encoding.
   • DOutput encoding and CSP, but not whitelist validation.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A Java application accepts a 'redirect' parameter that specifies a URL to redirect the user to after login. The security team found that an attacker can use a URL like 'https://evil.com' to perform an open redirect. The team wants to allow relative URLs (e.g., '/dashboard') but block absolute URLs to external domains. What is the best validation approach?

   • AValidate that the URL contains the application's domain name.
   • BEncode the URL using URL encoding before redirecting.
   • CCanonicalize the URL and then use a whitelist that allows only relative paths starting with '/'.
   • DUse a blacklist to remove URLs that contain 'http://' or 'https://'.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A Java web application accepts a 'username' field that must contain only letters, digits, and underscores, with a maximum length of 20 characters. The development team is deciding between a whitelist regex and a blacklist that removes common SQL injection characters. Which approach should they choose and why?

   • AUse a blacklist that strips characters like ', ;, --, and /* */ before processing.
   • BUse a blacklist that removes all non-alphanumeric characters except underscores.
   • CUse the whitelist regex ^[A-Za-z0-9_]{1,20}$ and reject any input that does not match.
   • DUse client-side JavaScript validation only, since it provides immediate feedback to users.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A Java application has a feature that allows users to specify a file name for a downloaded report. The file name is used in a Content-Disposition header. An attacker tried to inject a newline character to add a malicious header. What should the developer do to prevent this?

   • ARemove all non-alphanumeric characters from the file name.
   • BUse a blacklist to remove newline and carriage return characters.
   • CEncode the file name using URL encoding before putting it in the header.
   • DCanonicalize the file name and then validate it against a whitelist of allowed characters (e.g., alphanumeric, dash, underscore).
   Reveal Solution Discussion Select an answer first