Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A Java application processes a file upload. The filename is provided by the user and used to store the file on the server. Which of the following is the most secure way to handle the filename?

   • AUse the original filename directly to store the file.
   • BSanitize the filename by removing characters like '../' and then use it.
   • CGenerate a random filename on the server and store the original name only in a database.
   • DCheck that the filename ends with .txt and then use it.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which Java API is commonly used to validate input against a regular expression pattern?

   • Ajava.lang.String
   • Bjava.util.regex.Pattern
   • Cjava.sql.Connection
   • Djava.io.File
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A Java application accepts a 'sortBy' parameter that is used to construct an ORDER BY clause in a SQL query. The parameter is expected to be one of a fixed set of column names. Which validation approach is most appropriate?

   • AEscape the parameter and use it directly in the query.
   • BValidate that the parameter matches a whitelist of allowed column names.
   • CUse a prepared statement with the parameter as a bound value.
   • DUse a blacklist to block common SQL keywords like UNION and SELECT.
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A Java application uses Bean Validation (javax.validation) to validate user input in a REST API. The team wants to ensure that a field that should be a valid email address is properly validated. Which annotation should be used?

   • A@Email
   • B@Pattern(regexp = "...")
   • C@Size(min = 5, max = 100)
   • D@NotNull
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   At which stage of the software development lifecycle should input validation be integrated?

   • AOnly during the deployment phase
   • BOnly when a security incident occurs
   • CThroughout the entire development lifecycle, from design to maintenance
   • DOnly during the testing phase
   Reveal Solution Discussion Select an answer first