CSSLP: Certified Secure Software Lifecycle ProfessionalDemo

Question

Security code review identifies unvalidated input calls an attacker can make and prevents the server from processing them. It performs review checks on tainted servlet calls to identify unvalidated attacker input. Choose the appropriate review checks and place them before their respective functions.

Select and Place:

Drag & Drop

getParameter()

getQueryString()

getCookies()

getHeaders()

It is used to check the unvalidated sources of input from URI parameters in javax.servlet.HttpServletRequest class.

It is used to check the unvalidated source of input from Form fields in javax.servlet.HttpServletRequest class.

It is used to check the unvalidated sources of input from Cookies javax.servlet.HttpServletRequest class.

It is used to check the unvalidated sources of input from HTTP headers javax.servlet.HttpServletRequest class.

Explanation

Secure code review of Java web applications treats every value pulled from an HttpServletRequest as tainted attacker-controlled input. getQueryString() is the method used to read raw URI query parameters; getParameter() is used to read form-field data submitted in the request body; getCookies() is used to read cookie values sent by the client; and getHeader()/getHeaders() is used to read HTTP header values. Reviewers check each of these call sites because none of them perform input validation themselves.

CSSLP: Certified Secure Software Lifecycle ProfessionalDemo

AstroTutor

Notes

Readiness

QuestionQ179

Community Discussion