Input Related Flaws and Input Validation GWEB Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An application accepts a 'color' parameter that is later used in an HTML style attribute. The development team must choose a validation strategy. Which approach is most appropriate for this parameter?

   • ADenylist validation that blocks common HTML injection payloads such as '<script>' and 'onerror='.
   • BLength validation that limits the parameter to 10 characters.
   • CAllowlist validation that accepts only a fixed set of known color names or hex codes.
   • DType validation that ensures the parameter is a string.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A web application has a field for a ZIP code that must be exactly 5 digits. The development team is implementing validation. Which combination of checks is most appropriate?

   • AFormat check using a regular expression that matches any 5 characters.
   • BType check to ensure the input is numeric, length check to ensure it is exactly 5 characters, and format check to ensure it matches a 5-digit pattern.
   • CRange check to ensure the value is between 10000 and 99999.
   • DLength check only, ensuring the input is exactly 5 characters.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A web application has a 'role' parameter that determines user permissions. The valid roles are 'admin', 'editor', and 'viewer'. The application currently uses a denylist that blocks the string 'admin' in the parameter. A tester submits 'role=administrator' and gains admin access. Which validation approach would prevent this?

   • AAdd 'administrator' to the denylist.
   • BUse a regular expression that matches any string starting with 'a'.
   • CCheck that the role parameter length is less than 10 characters.
   • DUse an allowlist that only accepts the exact strings 'admin', 'editor', or 'viewer'.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A web application uses a parameter named 'page' to select which HTML template to include. The application validates that the value ends with '.html'. An attacker submits 'page=../../etc/passwd%00.html' and the application includes the file. What is the most likely reason the validation is bypassed?

   • AThe application is not using a parameterized query for the file include.
   • BThe application is not HTML-encoding the output.
   • CThe application does not canonicalize the input before checking the extension, and the null byte truncates the string in the file system call.
   • DThe application is using a denylist that does not include '..'.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which statement best describes the role of input validation in preventing injection attacks?

   • AIt ensures that only data matching the expected format is passed to interpreters, reducing the chance of malicious payloads being executed
   • BIt guarantees that all user input is harmless by removing any characters that could be used in an attack
   • CIt prevents all injection attacks by encoding output in every response
   • DIt only applies to form fields and does not affect URL parameters or headers
   Reveal Solution Discussion Select an answer first