Input Validation Approaches and Filtering CASENET Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A .NET application has a legacy input filter that blocks requests containing the string '<script' in any parameter. The team is considering replacing it with a more robust approach. Which option best addresses the limitations of the current filter?

   • AUse a regular expression to reject any input containing a '<' character.
   • BReplace the filter with output encoding at all rendering points and keep input validation for business rules.
   • CUse HTML encoding on all input before storing it in the database.
   • DExpand the blacklist to include all known XSS payloads and encoding variations.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A .NET application has a search feature that accepts a query string and displays results. The team has implemented both client-side and server-side validation. The client-side validation uses JavaScript to ensure the query is not empty and is less than 100 characters. The server-side validation uses a whitelist regex that allows only letters, digits, and spaces. A user reports that a valid search for 'C# programming' is rejected. What is the most likely cause?

   • AThe client-side validation is not working because the browser does not support JavaScript.
   • BThe server-side whitelist regex does not allow the '#' character, which is part of the search term.
   • CThe client-side validation is blocking the '#' character because it is a special character in JavaScript.
   • DThe server-side validation is checking the length of the query after URL decoding, which is longer than 100 characters.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which input validation approach rejects input that contains known malicious patterns, such as SQL keywords or script tags?

   • ABlacklist validation
   • BEncoding
   • CCanonicalization
   • DWhitelist validation
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security consultant is reviewing a .NET application that uses a blacklist to filter user input for a legacy search feature. The blacklist rejects inputs containing '<script', 'SELECT', and 'DROP'. The consultant notes that the application also URL-decodes input before filtering. What is the most likely remaining vulnerability?

   • AThe blacklist is case-sensitive, so 'Select' or 'Drop' would bypass it.
   • BThe blacklist is applied after SQL query construction, so it cannot prevent injection.
   • CThe application should use a whitelist instead of a blacklist to prevent all injection attacks.
   • DDouble-encoded payloads such as %253Cscript%253E will bypass the filter because the first decode produces %3Cscript%3E, which does not match the blacklist.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In .NET, which of the following is an example of implementing whitelist validation for a ZIP code field?

   • AUsing a regular expression like ^[0-9]{5}(-[0-9]{4})?$ to match the input
   • BRemoving all non-digit characters from the input
   • CEncoding the input as HTML before storing it
   • DChecking if the input contains any of the characters ';', '--', or '/*'
   Reveal Solution Discussion Select an answer first