Information Security

To prevent path traversal attacks, TCS SAPI provides isSafeDirectoryPath() and isSafeFileName(). Both methods take a context, input string, and allowNull flag. The 'isSafe' prefix methods (option C) are the correct API methods for validating path safety.

The correct signature is String hashPassword(String password, String accountName). The accountName is used as the salt, so it's required. Option A is missing the salt parameter, and option C has incorrect case (hashpassword instead of hashPassword).

The verifyPasswordStrength() method returns void because it doesn't return a value - it's typically a validation method that throws exceptions or callbacks for weak passwords. Password strength verification usually provides feedback through side effects, not return values.

Methods following the 'is' naming convention in Java typically return boolean values. The isAuthorizedForData() method checks authorization status, so boolean is the appropriate return type to indicate whether authorization is granted or denied.

CSRF tokens are typically string-based identifiers passed in HTTP headers or form parameters. The getCSRFToken() method returns the token as a String for easy integration with web requests and security validation.

The seal method in ESAPI encrypts data and embeds an expiration timestamp. This creates a secure token ensuring that the package cannot be tampered with or read, and will be rejected as invalid once the expiration timestamp has passed.

Cross-Site Scripting (XSS) occurs when untrusted input is executed in the browser. Input validation restricts malicious data from entering the application, and output encoding prevents the browser from interpreting user input as executable code, forming the best defense.

The sign method takes a single String parameter (the data to be signed) and throws SecurityException if signing fails or security constraints are violated. The method does not require an explicit key parameter as the key is managed internally by the security API.

The seal method accepts the data to be sealed and a timestamp parameter for time-based validation, returning a sealed String representation. It throws SecurityException when sealing operations fail due to security violations or invalid parameters.

Only the user-supplied parameter needs encoding, not the entire URL structure. Option C correctly encodes just the dangerous input while preserving the URL's query parameter syntax. Option A uses JavaScript encoding which is inappropriate for URL contexts, and Option B incorrectly encodes the entire URL string including the '=' delimiter.

When a user attempts to access a resource without proper authorization, the security API throws a SecurityException. This exception is specifically designed to indicate that the caller lacks the required permissions or rights to perform the requested operation. Generic exceptions like Exception are too broad, and AccessException is not a standard exception type in most security frameworks.

SecurityException is the most common exception thrown by validation methods in the security API. This exception occurs when validation checks fail, such as when input data doesn't meet security requirements or when access permissions are insufficient. Other exceptions like Encoding Exception or Encryption Exception are specific to different operations and not typically thrown during general validation.

EnterpriseSecurityException is the base class for all Security related exceptions in the security API. This class hierarchy allows for structured exception handling, where specific security exceptions can inherit from a common base. It provides a consistent way to catch and handle security-related errors throughout the application.

Canonicalization is the operation of reducing a possibly encoded string down to its simplest form. It's used in security to normalize input data by decoding all encoding layers, allowing for consistent validation. This helps prevent attacks that use multiple encoding layers to bypass security checks, such as double encoding or mixed encoding schemes.

The sign() method creates a digital signature for the provided input data and returns the signature in a string. Digital signatures provide authentication, integrity, and non-repudiation by using cryptographic algorithms to sign data. Unlike encryption (which hides data) or encoding (which transforms representation), signing provides a verifiable signature that proves the data originated from a specific source.