Information Security

The seal() method creates a cryptographic seal that binds data together with an expiration timestamp, providing tamper evidence and time-based validity. Unlike simple encoding, hashing, or scrambling, sealing provides integrity protection with temporal constraints.

Cross Site Scripting (XSS) attacks inject malicious scripts into web pages viewed by other users. The most effective defense combines input validation (rejecting malicious input) and output encoding (converting special characters to HTML entities). Authentication and cryptography protect against different threats, not XSS.

When users attempt unauthorized access, the security API throws SecurityException. AccessException (B) is not the standard exception here. AuthenticationException (C) would be for identity verification failures, not authorization.

Canonicalization is the process of converting data to a standard or canonical form. For security, it means reducing encoded strings (like %3C for <) to their simplest representation before validation. This prevents attackers from bypassing validation using double-encoding or alternate encoding schemes.

Digital signatures provide authentication, integrity, and non-reputation for digital data. The sign() method creates a cryptographic signature using a private key, allowing recipients to verify the data originated from the claimed source and hasn't been tampered with using the corresponding public key.

The seal() method in the security API encrypts a given data set and attaches an expiration timestamp, signing the package to verify integrity. This prevents unauthorized tampering or replay attacks. Simply encoding, hashing, or scrambling the data does not offer this timestamped, integrity-protected envelope functionality.

Combining input validation and output encoding forms the best defense against Cross-Site Scripting (XSS). Input validation rejects malformed data, while context-aware output encoding ensures that any allowed user input is treated as text rather than executable script when rendered in the browser. Other options address authentication or cryptography.

SecurityException is the standard exception thrown by security APIs when authorization fails. Unlike AccessException or generic Exception, SecurityException specifically indicates security-related authorization issues. AuthenticationException (misspelled in option C) would apply to authentication failures, not authorization.

Canonicalization reduces an encoded string to its simplest, equivalent form. For example, %41 (URL encoding) canonicalizes to 'A'. This is crucial for security because attackers can use multiple encodings to bypass filters - canonicalization reveals the true input.

The sign() method creates a digital signature for the input data and returns it as a string. Digital signatures provide authentication and integrity verification - they prove the data originated from a specific source and wasn't tampered with. This is different from encryption (confidentiality) or hashing (one-way).

The seal method in ESAPI encrypts data and embeds an expiration timestamp. This creates a secure token ensuring that the package cannot be tampered with or read, and will be rejected as invalid once the expiration timestamp has passed.

Cross-Site Scripting (XSS) occurs when untrusted input is executed in the browser. Input validation restricts malicious data from entering the application, and output encoding prevents the browser from interpreting user input as executable code, forming the best defense.

When a user attempts to access a resource without proper authorization, the security API throws a SecurityException. This exception is specifically designed to indicate that the caller lacks the required permissions or rights to perform the requested operation. Generic exceptions like Exception are too broad, and AccessException is not a standard exception type in most security frameworks.

Canonicalization is the operation of reducing a possibly encoded string down to its simplest form. It's used in security to normalize input data by decoding all encoding layers, allowing for consistent validation. This helps prevent attacks that use multiple encoding layers to bypass security checks, such as double encoding or mixed encoding schemes.

The sign() method creates a digital signature for the provided input data and returns the signature in a string. Digital signatures provide authentication, integrity, and non-repudiation by using cryptographic algorithms to sign data. Unlike encryption (which hides data) or encoding (which transforms representation), signing provides a verifiable signature that proves the data originated from a specific source.