Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team is integrating input validation into their CI/CD pipeline. They want to ensure that all new code follows secure coding standards. Which practice should they adopt?

   • ARequire manual code reviews for every change, focusing on input validation, and use a checklist.
   • BAdd a static analysis tool that flags common input validation issues and run it as part of the build.
   • CProvide training to developers on input validation and rely on their expertise to write secure code.
   • DImplement a centralized validation library and enforce its use through code reviews and static analysis.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Java web application displays user comments on a public page. The development team wants to prevent stored XSS. Which input validation strategy is most effective?

   • ARemove the string 'script' from the comment.
   • BReject any comment containing '<' or '>'.
   • CStore the comment as-is and escape it when rendering the HTML page.
   • DAllow only a safe whitelist of characters (letters, numbers, spaces, and basic punctuation).
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is context-specific validation important for inputs used in SQL queries?

   • ATo ensure the input is stored in the correct database column
   • BTo make the query run faster
   • CTo encrypt the data before sending it to the database
   • DTo prevent SQL injection by ensuring the input does not contain SQL metacharacters
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Java application allows users to upload profile pictures. The file name is used to store the file on the server. The security team is concerned about path traversal attacks. Which validation should be applied to the file name before storing it?

   • AReject any file name that contains path separators (/, \) or starts with a dot.
   • BGenerate a random file name server-side and ignore the user-supplied file name entirely.
   • CUse a blacklist to remove common path traversal sequences like ../ and ..\ from the file name.
   • DNormalize the file name by removing all non-alphanumeric characters and then use it in the file path.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Java application allows users to download files by specifying a filename in the URL. The files are stored in a directory called '/var/data'. Which of the following is the most secure way to prevent path traversal?

   • AReplace '../' with an empty string in the filename.
   • BUse the user-supplied filename directly in the file path.
   • CCheck that the filename does not contain a '/' character.
   • DCanonicalize the path and verify it starts with '/var/data/'.
   Reveal Solution Discussion Select an answer first