CAS-003 · Question #448
A security engineer is assisting a developer with input validation, and they are studying the following code block: The security engineer wants to ensure strong input validation is in place for…
The correct answer is C. Use regular expressions. Regular expressions provide a concise, pattern-based method to validate that input conforms to a specific format such as exactly ten numeric digits. They are both precise and computationally efficient, satisfying both the security and performance requirements.
Question
A security engineer is assisting a developer with input validation, and they are studying the following code block:
The security engineer wants to ensure strong input validation is in place for customer-provided account identifiers. These identifiers are ten-digit numbers. The developer wants to ensure input validation is fast because a large number of people use the system. Which of the following would be the BEST advice for the security engineer to give to the developer?
Exhibit
Options
- AReplace code with Java-based type checks
- BParse input into an array
- CUse regular expressions
- DCanonicalize input into string objects before validation
How the community answered
(56 responses)- A5% (3)
- B4% (2)
- C77% (43)
- D14% (8)
Why each option
Regular expressions provide a concise, pattern-based method to validate that input conforms to a specific format such as exactly ten numeric digits. They are both precise and computationally efficient, satisfying both the security and performance requirements.
Java type checks validate data type such as integer versus string but do not enforce length or character constraints, leaving the format insufficiently validated.
Parsing input into an array adds processing overhead and does not inherently validate the format or length of the account identifier.
A regular expression such as ^[0-9]{10}$ precisely constrains input to exactly ten numeric digits, rejecting any value that does not conform to the expected account identifier format. Regex validation is compiled at the pattern level and executes in near-constant time, making it one of the fastest input validation approaches available in most languages - directly addressing the developer's performance concern.
Canonicalization normalizes input encoding to a standard form as a preprocessing step before validation; it does not perform the actual format validation required for ten-digit identifiers.
Concept tested: Regular expressions for efficient and precise input validation
Source: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
Topics
Community Discussion
No community discussion yet for this question.