Computer Knowledge

Java Core Classes and Threads

1,935 Questions

Java core classes and threads form the foundation of object oriented programming and are crucial for IT officer and programming exams. This includes concepts like string mutability, collections, and multithreading. Solve these questions to test your practical coding and theoretical knowledge.

String and StringBuffer classesThread execution methodsJava collections frameworkCharacter streams input outputVariable serialization rules

Java Core Classes and Threads Questions

Multiple choice technology security

In the following code, which is the location of vulnerability? 

1 String username = req.getParameter("loginID"); 
2 String password = req.getParameter("loginPassword"); 
3 String sql = "SELECT UserID from Employee WHERE Emp_ID = ? AND Password=?"; 
4 pstmt = con.prepareStatement(sql); 
5 pstmt.setString(1,username); 
6 pstmt.setString(2,password); 
7 pstmt.execute(); 
8 user = pstmt.getResultSet(); 
9 if(user!=null)  
10 { 
11  while (user.next()) 
12  { 
13   userInfo.add(user.getString(1)); 
14  }  
15 } 
16 else 
17 { 
18  log.debug(“Invalid Login: Login ID-”+ username+” Password-”+ password); 
19 }

  1. Line 5

  2. Line 4

  3. Line 18

  4. Line 11
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Line 18 contains a vulnerability because it logs the raw, sensitive password parameter. In contrast, the SQL query execution on lines 3-7 is secure since it uses a parameterized PreparedStatement which prevents SQL injection.

Multiple choice technology security

Give the name of the vulnerability resides in the below code: 

... 
Runtime rt = Runtime.getRuntime(); 
Process proc = rt.exec("cmd.exe /c type "+request.getParameter("path")); //path is an Input Parameter and contains the file name. 
InputStream stdin = proc.getInputStream(); 
InputStreamReader isr = new InputStreamReader(stdin); 
BufferedReader br = new BufferedReader(isr);              
...

  1. Race Condition

  2. Command Injection

  3. Denial of Service

  4. Cross Site Request Forgery
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

The parameter path is fetched directly from the request and concatenated into a shell command executed by Runtime.getRuntime().exec(). An attacker can manipulate this parameter (e.g., using & or |) to execute arbitrary command line arguments on the host system.

Multiple choice technology security

Identify the Vulnerable Line # in the below code:

1 ...   
2 public static Connection getConnection()    
3 {   
4  Connection con = null;   
5  try   
6  {   
7   Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");   
8   con = DriverManager.getConnection("jdbc:odbc:Lookup","admin","admin");   
9    
10  }catch (ClassNotFoundException e)   
11  {   
12   if(con!=null)  
13    close(con);  
14   log.debug(“Error Occurred:” + e);   
15    
16  } catch(SQLException ex)  
17  {   
18    
19   if(con!=null)  
20    close(con);  
21   log.debug(“Error Occurred:” + ex);  
22  }  
23  return con;   
24 }  
25 ...

  1. Line # 4

  2. Line # 13 & 20

  3. Line # 7 & 8

  4. None of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Lines 7 and 8 contain the security vulnerabilities. Line 7 loads the obsolete and insecure JDBC-ODBC bridge driver. Line 8 contains hardcoded database credentials ("admin"/"admin"), exposing the application to credential theft and unauthorized access.