Secure Coding and Vulnerabilities Quiz
Test your knowledge of secure programming practices, common vulnerabilities like SQL injection, buffer overflow, and command injection, and memory management security in Java and C/C++.
Questions
int main(int argc,char* argv[]) {
int *ptr1=new int;
if(ptr1==NULL) exit(1);
int *ptr2=new int;
if(ptr2==NULL) exit(1);
char* j;
j=argv[1];
int k=atoi(j);
if (j==0){
Ptr1=&k;
delete ptr2; /*1*/
}
else {
Ptr2=&k;
}
delete ptr1; /*2*/
delete ptr2; /*3*/
return 0;
}
which line of the code should be deleted to remove vulnerability
- line 1 and line 3
- line 2 and line 3
- line 1
- line 3
char *name="32000"; What will be sizeof(name) return?
- 4 - it is the size of the pointer
- 5 - it is the number of characters in the string that the pointer points to
- 4 - it is the size when 32000 is stored as integer
- 1 - it is the size of a character variable
int main(int argc,char* argv[]){
int *ptr=new int;
if(ptr==NULL) exit(1);
char *j;
for(int i=1; i<=4; i++) {
j=argv[i];
int k=atoi(j);
if (k!=0){
*ptr=k;
delete ptr;
}
}
}
Will this program execute successfully ?
- program works when there is only 1 argument with program.
- program works when there are 3 arguments with program.
- program works when there are 4 arguments with program.
- program never executes successfully.
unsigned int i;
scanf("%u",&i);
With the size of unsigned integers being 4 bytes, What happens when a negative number is entered?
- A run-time error is encountered and the program aborts.
- unsigned int variables cannot store the sign (+ or -) of the number. The sign is discarded and only the number is stored in i.
- A large positive number will be stored in i.
- Unsigned int variables cannot store signed numbers. Hence in this program i will contain garbage values.
int i=987987987;
int j= i*10;
what is the value of j (size of integer is 4 bytes)?
- 1289945278
- garbage. Integer j cannot hold such large values
- 9879879870
- Program is aborted.
The application is receiving input from an external source. Which of the following external sources can be considered safe?
- Shell environment variables
- Data received via encrypted network channels
- argv[0] can only have either null or program name
- no external input must be trusted
In the following code snippet, should the pointer be deleted?
int main (int argc, char *argv[]) {
char* j;
j=argv[1];
int k=atoi(j);
/*delete here*/
return 0;
}
- delete j;
- realloc j;
- free j;
- It need not be deleted
How many of following are security code review tools
- OWASP WebScarab
- Fortify
- WebInspect
- AppScan
- Nikto
- FindBugs
- 1
- 2
- 4
- 6
int main(char* argc, char** argv) {
char cmd[CMD_MAX] = "/usr/bin/cat ";
strcat(cmd, argv[1]);
system(cmd);
}
Code is vulnerable to buffer overflow attack and
- DNS Spoofing
- Command Injection
- Path Traversal
- Both 2 and 3
What can go wrong in following code?
#include <stdio.h>
int main(int argc, char *argv[]){
if(argc != 3){
printf("usage: %s [source] [dest]n", argv[0]);
exit(1);
}
char buffer1[5];
strcpy(buffer1, argv[1]);
char buffer2[5];
strcpy(buffer1, argv[1]);
char x;
FILE *file[2];
file[0] = fopen(buffer1,"r+");
file[1] = fopen(buffer2,"w+");
for(x = 0; x < 2; x++){
if(file[x] == NULL){
printf("error opening file.n");
exit(1);
}
}
do {
x = fgetc(file[0]);
fputc(x,file[1]);
}
while(x != EOF);
for(x = 0; x < 2; x++)
fclose(file[x]);
return 0;
}
- XSS
- Arc Injection
- Buffer Overflow
- both 2 and 3
In the following code snippet, how should a pointer be deleted
int main (int argc, char *argv[]) {
char* j=new char[100];
j=argv[1];
int k=atoi(j);
/*delete here*/
return 0;
}
- delete j
- free j
- it is not supposed to be deleted
- delete [] j
A program wants to do some activities with root privileges when it starts up and shuts down. Other activities it does can be done as a lesser privileged user. Which of the options given below is most secure?
- The program should be started with root privileges. Then it should use setuid(UID) to change privileges between root and another account.
- The program should be started with root privileges. Then it should use seteuid(UID) to change privileges between root and another account.
- Starting the program as root is a security risk. The program should run with least privileges and obtain root using seteuid(UID) whenever necessary.
- The program has to run with root privileges entirely. Once root privileges are dropped they cannot be regained.
What value is stored in *leaf in the program given below?
int *myfunc(int tree) {
int *node;
int i=rand();
if(0==tree/pow(2,i))
node=&tree;
else
node=&i;
return node;
}
int main(int argc, char * argv[]) {
int *leaf;
leaf=myfunc(7);
}
- value of tree
- value of node
- value of i
- garbage-- its a dangling pointer
List the correct entries in the web.xml deployment descriptor for Exception & Error Handling
- <error-page> <exception-type>java.lang.Throwable</exception-type> <location>/error.jsp</location> </error-page>
- <error-page> <error-code>500</error-code> <location>/error.jsp</location> </error-page>
- <error-page> <location>/error.jsp</location> </error-page>
- a & b
Choose the correct answer:
- HTTP PUT & DELETE method can be disabled in web.xml from the below code: <Web-resource-collection> <web-resource-name>Disallowed Location</web-resource-name> <url-pattern>/*</url-pattern> <http-method>PUT</http-m
- HTTP PUT & DELETE methods are disabled by default
- HTTP PUT & DELETE methods should not be disabled
- HTTP PUT & DELETE methods cannot be disabled
try {
//code to do IO operations
return var1;
} Catch(Exception e) {
return var2;
} finally{
return var3;
}
From security view point problem with above code is
- It is returning a value in finally block
- It is catching Exception
- Both a & b
- Nothing is wrong
public void dummyFunction(String var1,String var2){
try{
Connection con=getConnection();
String query=”select * from table1 where col1=”+var1 +”and col2=”+var2;
Statement st=conn.createStatement();
ResultSet rs=st.executeQuery(query);
…… …..
} catch(Exception e) { }
}
var1 and var2 are inputs from user directly passed to this functions. This code is
- Vulnerable to SQL Injection
- Vulnerable to DoS
- Both a & b
- None of the above
Below function is used to read file from a directory on the filesystem. This code runs with read only OS level privilege on this directory. fileName is parameter from user directly passed to this function
public void dummyFunction(String fileName){
FileInputStream fis = new FileInputStream(fileName); // code to read file content only, no write modify or delete
}
- Security is handled at OS level by giving only read level privilege so no need to put an extra check here.
- Only problem here is that fileName may not be syntactically incorrect so it should be validated before using it in the function.
- This code can lead to information disclosure attack
- Java provides enough security by default for IO operations so this code is not vulnerable.
Please select which of the following statements are NOT true regarding the AccessController class?
- Can be used to mark code as being "privileged", thus affecting subsequent access determinations
- Can be to decide whether an access to a critical system resource is to be allowed or denied, based on the security policy currently in effect
- Can be used to obtain a "snapshot" of the current calling context
- Can be used to compute a cryptographically secure hash
Which of the following best describes how to sign a document using a digital signature?
- Create a hash of the document and encrypt the resulting hash using the signer's private key
- Encrypt the document using the signer's private key
- Encrypt the document using the signer's private key and create a hash of the encrypted document
- Encrypt the document using the signer's public key