Input Validation Approaches and Filtering CASENET Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   Which regular expression would you use to validate that a string contains only lowercase letters and is exactly 5 characters long?

   • A^[a-z]+$
   • B^[a-z]{5}$
   • C^[A-Za-z]{5}$
   • D^[a-z]{1,5}$
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A .NET API accepts a 'date' parameter as a string. The parameter must be a valid date in the format yyyy-MM-dd and must not be in the future. The current code uses DateTime.TryParseExact with the format and then compares to DateTime.UtcNow. What is a potential issue with this approach?

   • AThe format string 'yyyy-MM-dd' is case-sensitive and will reject valid dates like '2023-1-1'.
   • BDateTime.TryParseExact is not available in .NET Core, so the code will not compile.
   • CDateTime.TryParseExact may accept values like '2023-02-29' if the calendar is not specified.
   • DThe comparison to DateTime.UtcNow does not account for time zones, so a date that is valid in one time zone may be in the future in another.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following best describes the role of client-side validation?

   • AIt is the primary security control for validating user input.
   • BIt ensures that data is safe before it reaches the server.
   • CIt improves user experience by providing immediate feedback without a round trip to the server.
   • DIt replaces the need for server-side validation.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A .NET application has a feature that accepts a file path from the user and opens the file. The developer implemented a whitelist that only allows paths starting with 'C:\Safe\'. A penetration test found that an attacker can bypass this by using the path 'C:\Safe\..\Secret\file.txt'. What is the most effective fix?

   • ACanonicalize the path using Path.GetFullPath() and then check that the result starts with 'C:\Safe\'.
   • BCheck that the path length is less than 260 characters and then open the file.
   • CReject any path that contains '..' as a substring.
   • DUse a regular expression to ensure the path matches '^C:\\Safe\\[a-zA-Z0-9]+$'.
   Reveal Solution Discussion Select an answer first