Câu 27: CAS-002: CompTIA Advanced Security Practitioner (CASP)

A developer has implemented a piece of client-side JavaScript code to sanitize a users provided input to a web page login screen. The code ensures that only the upper case and lower case letters are entered in the username field, and that only a 6-digit PIN is entered in the password field. A security administrator is concerned with the following web server log:10.235.62.11 – - [02/Mar/2014:06:13:04] "GET /site/script.php?user=admin&pass=pass%20or%201=1 HTTP/1.1" 200 5724Given this log, which of the following is the security administrator concerned with and which fix should be implemented by the developer?

1. A. The security administrator is concerned with nonprintable characters being used to gain administrative access, and the developer should strip all nonprintable characters.
2. B. The security administrator is concerned with XSS, and the developer should normalize Unicode characters on the browser side.
3. C. The security administrator is concerned with SQL injection, and the developer should implement server side input validation. — đáp án hiện tại
4. D. The security administrator is concerned that someone may log on as the administrator, and the developer should ensure strong passwords are enforced.