"SELECT name FROM users WHERE id = " + form.getUserID()"; Using TCS SAPI what is the best way to remediate the SQL injection vulnerability in the above query to an Oracle Database?
"SELECT name FROM users WHERE id = " + com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(validatedUserId);
"SELECT name FROM users WHERE id = " + com.tcs.sapi.io.ValidationUtil.encodeForSQL(validatedUserId);
"SELECT name FROM users WHERE id = " + com.tcs.sapi.io.ValidationUtil.encodeForSQL( new Codec(), validatedUserId);
None of the above
What is the best methodology to remediate the SQL Injection vulnerability in a Java based web application?
Use the com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(String input) method
Use PreparedStatement constructs and use the setXXX methods on the PreparedStatement object
Use the Java createStatement construct to execute the query
Concatenate your SQL string together using dynamic input and create and execute a PreparedStatement object using that query
Which among the below is the correct way to safely encode the URL "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" )
String safeURIToDisplay= "/admin/findUser.do?name=" + TCSSAPI.encoder().encodeForJavaScript(request.getParameter( "dangerousInput"));
String safeURIToDisplay = TCSSAPI.encoder().encodeForURL( "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" ) );
String safeURIToDisplay= "/admin/findUser.do?name=" + com.tcs.sapi.io.ValidationUtil.encodeForURL(request.getParameter( "dangerousInput"));
Whats the use of adding the CSRF Token to the urls?
Prevent Cross Site Scripting
Prevent Cross Site Request Forgery
Prevent Cross Site Tracing
What does isSecureRequest(HttpServletRequest request) method accomplish?
It checks if the http request is made on an SSL channel
It checks if the http method is a POST
Both of the above
What messages does an object of EnterpriseSecurityException class contain?
Log Message which gets logged in the log file and not safe to display to users
User Message which is safe to display to users
What exception is thrown by the security API when a user attempts to access a resource that they are not authorized for?
SecurityException
AccessException
AuthenitcationException
Exception
What is the most common exception thrown by the validation methods in the security API?
Validation Exception
Encoding Exception
Encryption Exception
The usage of setRememberToken is
Generally recommended
Generally not recommended
Should always be used
Should not be used at all
What are the different levels of logging provided in the API?
Trace, warn, error and fatal
Trace, debug, info, warn, error and fatal
Debug, info, error, fatal
Debug, Warn, Error