Input Related Flaws and Input Validation GWEB Practice Questions (Page 9)

Questions 41–44

1. 41foundation · easy

   Which scenario is a denylist (blacklist) validation approach most appropriate for?

   • AEnsuring a username contains only letters and numbers
   • BVerifying that an email address matches a standard email format
   • CBlocking a specific set of known malicious strings in a log entry field
   • DValidating a user's age to ensure it is between 18 and 120
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the purpose of canonicalization in input validation?

   • ATo remove all special characters from input to make it safe
   • BTo convert input into a standard, unambiguous form so that validation rules are applied consistently
   • CTo encrypt input so that it cannot be read by an attacker
   • DTo compress input to reduce storage requirements
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security team is reviewing an application that uses a parameter named 'id' in a database query. The application performs validation by rejecting any input that contains the string 'OR' (case-insensitive). An attacker submits 'id=1%20oR%201%3D1' and the query returns all records. The team is considering several fixes. Which fix is most robust against this and similar bypasses?

   • AExpand the denylist to include 'oR', 'Or', and '%20'.
   • BUse parameterized queries and validate that 'id' is an integer.
   • CReject any input containing a space or percent sign.
   • DDecode the input once before validation.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A web application receives a 'redirect' parameter that is used in a 'Location' header after login. The application validates that the parameter starts with 'https://'. An attacker submits 'https://evil.com' and the application redirects the user to the malicious site. Which validation technique would best prevent this open redirect?

   • ACheck that the URL contains the string 'https://' anywhere in the value.
   • BValidate that the redirect URL is on an allowlist of trusted domains.
   • CURL-encode the redirect parameter before using it in the header.
   • DUse a denylist of known malicious domains.
   Reveal Solution Discussion Select an answer first