PT0-002 · Question #321
During a code review assessment, a penetration tester finds the following vulnerable code inside one of the web application files: <% String id = request.getParameter("id"); %> Employee ID: <%= id…
The correct answer is C. Output encoding. Output encoding is a technique that prevents cross-site scripting (XSS) attacks by encoding the user input before displaying it on the web page. This way, any malicious scripts or HTML tags are rendered harmless and cannot execute on the browser. Output encoding is recommended…
Question
During a code review assessment, a penetration tester finds the following vulnerable code inside one of the web application files:
<% String id = request.getParameter("id"); %> Employee ID: <%= id %> Which of the following is the BEST remediation to prevent a vulnerability from being exploited, based on this code?
Options
- AParameterized queries
- BPatch application
- COutput encoding
- DHTML sanitization
How the community answered
(28 responses)- A11% (3)
- B4% (1)
- C79% (22)
- D7% (2)
Explanation
Output encoding is a technique that prevents cross-site scripting (XSS) attacks by encoding the user input before displaying it on the web page. This way, any malicious scripts or HTML tags are rendered harmless and cannot execute on the browser. Output encoding is recommended by the OWASP Top 10 as a defense against XSS. In this case, the vulnerable code is using a scriptlet to display the employee ID without any validation or encoding, which could allow an attacker to inject malicious code through the id parameter. Output encoding would prevent this by escaping any special characters in the id parameter.
Topics
Community Discussion
No community discussion yet for this question.