Tag: security

Use the com.tcs.sapi.io.ValidationUtil.encodeForOraSQL(String input) method

Use PreparedStatement constructs and use the setXXX methods on the PreparedStatement object

Use the Java createStatement construct to execute the query

Concatenate your SQL string together using dynamic input and create and execute a PreparedStatement object using that query

String safeURIToDisplay= "/admin/findUser.do?name=" + TCSSAPI.encoder().encodeForJavaScript(request.getParameter( "dangerousInput"));

String safeURIToDisplay = TCSSAPI.encoder().encodeForURL( "/admin/findUser.do?name=" + request.getParameter( "dangerousInput" ) );

String safeURIToDisplay= "/admin/findUser.do?name=" + com.tcs.sapi.io.ValidationUtil.encodeForURL(request.getParameter( "dangerousInput"));

None of the above

Prevent Cross Site Scripting

Prevent Cross Site Request Forgery

Prevent Cross Site Tracing

None of the above

It checks if the http request is made on an SSL channel

It checks if the http method is a POST

Both of the above

None of the above

Log Message which gets logged in the log file and not safe to display to users

User Message which is safe to display to users

Both of the above

None of the above

SecurityException

AccessException

AuthenitcationException

Exception

Validation Exception

SecurityException

Encoding Exception

Encryption Exception

Generally recommended

Generally not recommended

Should always be used

Should not be used at all

Trace, warn, error and fatal

Trace, debug, info, warn, error and fatal

Debug, info, error, fatal

Debug, Warn, Error

isSafeHTML(java.lang.String context, java.lang.String input, boolean allowNull) and encodeForHTML(java.lang.String input)

isSafeHTML(java.lang.String context, java.lang.String input)

SafeHTML(java.lang.String context, java.lang.String input)

ValidHTML(java.lang.String context, java.lang.String input)