Input Validation Approaches and Filtering CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A .NET API endpoint accepts a JSON payload with a 'quantity' field. The field should be an integer between 1 and 100. The current code uses Convert.ToInt32() without any range check. What is the most secure way to validate this input?

   • AUse Convert.ToInt32() and rely on the fact that it throws an exception for non-numeric input.
   • BUse int.TryParse() and then check that the parsed value is between 1 and 100.
   • CCheck that the input string length is less than 10 characters and then use it directly in a calculation.
   • DUse a regular expression to match ^[0-9]+$ and then use the value directly.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A team is designing a validation module for a .NET application that accepts various types of input: a phone number, a ZIP code, and a user ID. They want to use whitelist validation for all fields. What is the most important principle to apply?

   • AUse client-side validation only because it is faster and easier to implement.
   • BUse a blacklist to remove any characters that are not in the whitelist.
   • CUse a single global whitelist that allows only alphanumeric characters for all fields.
   • DDefine a specific whitelist pattern for each field based on its expected format.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which .NET method is commonly used to HTML-encode a string before rendering it in a web page?

   • AString.Format()
   • BConvert.ToBase64String()
   • CHttpUtility.HtmlEncode()
   • DRegex.Replace()
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A file download endpoint in an ASP.NET Core application accepts a filename parameter and uses it to read a file from a directory. A penetration test revealed that an attacker can use encoded path traversal sequences like %2e%2e%2f to escape the directory. The developer wants to fix this while still allowing legitimate filenames. What should the developer do?

   • AUse a blacklist of known traversal strings such as '..\' and '../' and reject the request if any are found.
   • BReplace all occurrences of '..' with an empty string in the input before constructing the file path.
   • CReject any input that contains a backslash or a forward slash.
   • DDecode the input, normalize it to a full path, and verify that the normalized path starts with the intended base directory before allowing the download.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary use of regular expressions in input validation?

   • ATo remove all non-alphanumeric characters
   • BTo canonicalize input paths
   • CTo define and enforce input format constraints
   • DTo encode dangerous characters
   Reveal Solution Discussion Select an answer first