Multiple choice technology security

Which among the below is the correct way to safely encode the URL "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" )

  1. String safeURIToDisplay= "/admin/findUser.do?name=" + TCSSAPI.encoder().encodeForJavaScript(request.getParameter( "dangerousInput"));

  2. String safeURIToDisplay = TCSSAPI.encoder().encodeForURL( "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" ) );

  3. String safeURIToDisplay= "/admin/findUser.do?name=" + com.tcs.sapi.io.ValidationUtil.encodeForURL(request.getParameter( "dangerousInput"));

  4. None of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The correct approach encodes only the dangerous user input parameter using encodeForURL, not the entire URL. Option A uses JavaScript encoding which is wrong for URL parameters. Option B encodes the entire URL which would break the URL structure. Only the user input needs encoding.

Keep practicing — related questions