Exam 350-901 topic 1 question 138 discussion

B. Limit user input to acceptable characters. E. Remove all HTML/XML tags from user input.

B. Limit user input to acceptable characters. E. Remove all HTML/XML tags from user input.

Correct answers: B & E B. Limit user input to acceptable characters. E. Remove all HTML/XML tags from user input. https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

B and E are correct: "To mitigate this attack, the easiest way is to escape any user input, both when receiving it from the user and when sending data to other users. For example, replacing the < character with &lt; or &#60; for the web content would disable all HTML tags. In Python, this can be done with the standard html.escape() and html.unescape() functions. Sometimes some HTML tags are acceptable, so escaping them all is not an option. In this case, sanitization is a suitable solution. Sanitization processes untrusted user input and runs it through the filter, which allows valid content but strips anything that is not permitted. For example, it may allow <A>, <IMG>, <B> HTML tags but strip any other tags."

B and E

I agree with PopLife: B. Limit user input to acceptable characters. This might be related to the concept of XSS Filters/Sanitization, in which you take the untrusted user input and strip out anything that is not permitted. E. Remove all HTML/XML tags from user input. It might related to the concept XSS Escaping. Like HTML, CSS, XML, Javascripts Escaping. https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Agree with PopLife, answer should be 'B & E'