Input Validation Approaches and Filtering CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A developer is implementing a chat feature where users can send messages that are displayed to other users. The team wants to allow some HTML formatting like <b> and <i> but prevent XSS. What is the most secure approach?

   • AEncode the entire message and then use a client-side library to decode and render it.
   • BUse a blacklist of dangerous tags like <script> and <iframe> and remove them.
   • CStore the message as HTML and rely on the browser's built-in XSS protection.
   • DUse a whitelist of allowed HTML tags and encode everything else before rendering.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A .NET web application displays user-supplied comments on a page. The team wants to prevent cross-site scripting (XSS) by encoding the output. Which approach is most effective?

   • AUse JavaScript encoding when rendering the comment in the HTML response.
   • BUse a blacklist to remove all <script> tags from the input.
   • CUse URL encoding when rendering the comment in the HTML response.
   • DUse HtmlEncode when rendering the comment in the HTML response.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An ASP.NET Core application allows users to upload profile pictures. The filename is taken from the user's input and used to save the file on the server. A security review found that an attacker could upload a file with a name like '..\..\wwwroot\malicious.aspx'. What is the best defense?

   • ARemove all backslashes and forward slashes from the filename before saving.
   • BGenerate a random filename on the server and ignore the user-supplied filename entirely.
   • CUse Path.GetFullPath() and check that the result starts with the upload directory.
   • DCheck that the filename does not contain '..' and then save it.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which validation approach is considered most secure because it only accepts input that matches a predefined set of allowed patterns?

   • ABlacklist validation
   • BCanonicalization
   • CWhitelist validation
   • DEncoding
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which input validation approach is based on defining a set of acceptable patterns and rejecting anything that does not match?

   • ACanonicalization
   • BWhitelist validation
   • CBlacklist validation
   • DEncoding
   Reveal Solution Discussion Select an answer first