Input Related Flaws and Input Validation GWEB Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A web application has a registration form that uses JavaScript to enforce a strong password policy (minimum length, complexity, and character set). A penetration test reveals that an attacker can submit a weak password directly via a crafted HTTP request, bypassing the client-side checks. Which remediation should the development team implement?

   • AStrengthen the JavaScript validation to include additional complexity rules and obfuscate the script to make it harder to reverse-engineer.
   • BUse a hidden form field to indicate that the client-side validation passed, and only accept the submission if that field is present.
   • CRemove client-side validation entirely to ensure that all validation is performed only on the server.
   • DAdd the same password policy checks to the server-side registration endpoint and return a generic error message when validation fails.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it important to log validation failures securely?

   • ATo detect and analyze attack attempts without exposing sensitive data in the logs
   • BTo ensure that all invalid input is automatically corrected
   • CTo provide users with a detailed history of their mistakes
   • DTo comply with legal requirements that all user input must be stored
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A development team is building a public-facing registration form that includes a username field. They have implemented JavaScript validation to enforce a 3–20 character length and an alphanumeric pattern. A security reviewer insists that server-side validation is still required. Which reason best supports the reviewer's position?

   • AServer-side validation is needed to prevent users from submitting the form more than once.
   • BClient-side validation can be bypassed by an attacker who disables JavaScript or submits crafted HTTP requests directly.
   • CServer-side validation is required to ensure the username is displayed correctly in the browser after submission.
   • DClient-side validation cannot enforce length checks, so server-side validation is needed to enforce the 3–20 character limit.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of input validation in a web application?

   • ATo replace all user input with a fixed set of safe characters
   • BTo encrypt all user input before it is stored in the database
   • CTo log every user input for auditing purposes
   • DTo ensure that all user-supplied data conforms to expected rules before it is processed
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A web application allows users to enter a 'name' that is later used in three different contexts: an SQL query, an HTML page, and a shell command. The development team wants to apply a single validation rule to the input. Which approach is most secure?

   • AApply the same validation rule and rely on the database, browser, and shell to handle the input safely.
   • BUse a denylist that blocks common injection characters like quotes, semicolons, and pipes.
   • CUse a single strict allowlist of alphanumeric characters and apply it to all contexts.
   • DUse parameterized queries for SQL, HTML-encode for output, and use a shell API that does not invoke a command interpreter.
   Reveal Solution Discussion Select an answer first