Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Java web application uses Bean Validation (javax.validation) to validate a form object. The developer wants to ensure that the 'email' field is a valid email address. Which annotation should be used?

   • A@Email
   • B@Size
   • C@Pattern
   • D@NotNull
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A development team is adopting a secure coding standard. They want to ensure that all input validation is consistently applied across the codebase. Which practice is most effective?

   • AUse a static analysis tool only, without any code review.
   • BRely on each developer to write validation code as they see fit.
   • CDocument validation requirements but do not enforce them.
   • DCreate a centralized validation utility class and enforce its use through code reviews.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A Java application has a global exception handler that logs all exceptions. The team wants to ensure that sensitive data is not logged. Which practice should they follow?

   • ADo not log exceptions at all to avoid sensitive data exposure.
   • BLog the exception class and message, but redact any sensitive data like passwords or credit card numbers.
   • CLog only the exception message, not the stack trace.
   • DLog the full stack trace and all input parameters for debugging purposes.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A development team is implementing input validation for a legacy Java application. The application has many entry points, and the team has limited resources. They want to prioritize the most critical validation. Which approach should they take?

   • AValidate all inputs with a generic whitelist of alphanumeric characters.
   • BUse a blacklist to remove common attack patterns from all inputs.
   • CImplement validation only for new features and leave legacy code unchanged.
   • DFocus on validating inputs that are used in security-sensitive contexts like SQL queries, OS commands, and HTML output.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Java application allows users to upload XML files that are parsed and displayed in a web page. The team wants to prevent XXE (XML External Entity) attacks. Which validation and parsing approach should they use?

   • AEscape the XML output before displaying it in the web page.
   • BUse a secure XML parser that disables external entities and DTDs.
   • CValidate the XML against a schema before parsing.
   • DUse a blacklist to remove DOCTYPE and ENTITY from the XML input.
   Reveal Solution Discussion Select an answer first