Input Validation Approaches and Filtering CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A .NET application has a search feature that accepts a user-supplied string and uses it in a SQL query. The team wants to block obvious SQL injection attempts by rejecting input that contains common SQL keywords like 'SELECT', 'DROP', or 'UNION'. What is a major weakness of this approach?

   • AThe filter will not work because SQL keywords are case-sensitive in SQL Server.
   • BThe filter will block legitimate search terms that contain these words, such as 'selection' or 'dropbox'.
   • CAttackers can use alternative encodings, comments, or case variations to bypass the keyword filter.
   • DThe filter is too strict and will reject all user input, making the search feature unusable.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the purpose of canonicalization in input validation?

   • ATo limit input length to a predefined maximum
   • BTo reject input that contains known malicious patterns
   • CTo convert input into a standard, unambiguous form to prevent bypasses via encoding or path traversal
   • DTo encode dangerous characters so they are not interpreted as code
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A .NET application accepts a URL from user input and later uses it to make an HTTP request. Security testing found that an attacker can use URL encoding to bypass a filter that blocks requests to internal IP addresses. What is the best way to prevent this?

   • ATrust the URL because it was provided by an authenticated user.
   • BUse a regular expression to reject any URL that contains a digit.
   • CUse a blacklist to reject any URL containing the string '127.0.0.1'.
   • DDecode the URL and resolve the hostname to an IP address, then check that the IP is not in a private range.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A .NET application has a multi-step form where the user selects a product category from a dropdown, then enters a product name. The product name is later displayed on a public page. The team is deciding on a validation strategy. Which combination of approaches is most secure and user-friendly?

   • AUse client-side validation for both fields and trust the server to handle any invalid input.
   • BUse a blacklist for the category and a blacklist for the product name to block dangerous characters.
   • CUse an allowlist for the category and a whitelist regex for the product name, and encode the product name when displaying it.
   • DUse a whitelist regex for the category and allow any product name, but encode it when displaying.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A .NET application accepts a base64-encoded string from a query parameter. The string is decoded and then used as a file name. The team wants to prevent path traversal. What is the best approach?

   • ATrust the base64 string because it is encoded and not human-readable.
   • BDecode the base64 string, then canonicalize the resulting file name with Path.GetFullPath and verify it is within the allowed directory.
   • CReject any base64 string that contains the characters '/', '\', or '..' after decoding.
   • DUse a regular expression to validate the base64 string format before decoding.
   Reveal Solution Discussion Select an answer first