Quiz 8

With which of the following JavaScript statements might a developer accidentally generate an infinite loop?

A for statement

What is a signed script?

A program that can perform operations once considered a security risk

Which description best fits the JavaScript security issue known as frame-to-frame URL changing?

A technique in which one frame in a frameset can direct another frame to display a different page

How can a user control cookies in his or her browser?

Adjust browser settings to choose which cookies to accept.

Which statement best describes how cookies are generally used?

Almost every commercial Web site uses cookies to track user activities and maintain state.

Which example is a way that users can protect themselves from browser-specific security problems?

Always keep your anti-virus software and patches up to date.

Cookies can be used for many reasons. If cookies are used for authentication, which hazard is presented?

An unauthorized user can log on to a password-protected site by using an authorized user's computer.

The Ultimate Browser Sniffer script is a classic example of a complex vendor/version client-side detection strategy that employs the user agent string and requires code forks for many browsers and versions. Developers are advised against using this type of script. What is this script's specific disadvantage?

Attempting to perform browser detection to this level of detail is impossible to maintain.

Script-blocking tools enable users to block JavaScript code and other executable content. Why are script blockers used?

Because scripts can be malicious or annoying for the end user

Which statement about browser detection is true?

Browser detection is still essential because you must balance standards-based content with support for various modern and older browsers.

Which term is used to describe the practice, either legitimate or malicious, when one frame in a frameset redirects a URL, and the browser still displays the URL of the frameset document — rather than the URL of the target page — in the address bar?

Cloaking

You are browsing a Web site that uses a frameset for its page design. As you click links on the main page, you see the site's supporting pages appear in the other frames. One of the supporting pages asks you to enter your e-mail address to subscribe to the site's blog. You glance at your browser's address bar and see that you are still on the legitimate site you originally accessed, so you go ahead and enter your address. Shortly after that, you are inundated with e-mail messages promoting pornography sites. Which malicious scripting technique has been perpetrated?

Cloaking

Cross-site scripting (XSS) is a form of what type of attack?

Code injection

As you develop your Web pages, there are practices you can follow to ensure that your pages are secure for your users. Which of the following practices can help you find a security issue in your code easier and faster if a problem occurs?

Comment your code liberally.

Which term is used to describe a small piece of information sent to a client computer via the browser and stored in memory to help maintain state and track user activities?

Cookie

As a developer, what can you do to work around the problems with document.write rendering in some browsers?

Create multiple versions of the page that conform to the appropriate HTML or XHTML standard, then use the navigator object to detect the user's browser type.

Consider a security vulnerability in which an attacker embeds malicious script into a link that appears to be from a trusted site. Upon clicking the link, the embedded script is submitted in the client's HTTP request and can execute on the user's computer, enabling the attacker to steal information. Which term is used to describe this security issue?

Cross-site scripting

Which practice is currently one of the most popular sources of hacking?

Cross-site scripting

You receive an e-mail message from what appears to be a trusted Web site, your bank. Upon clicking a link in the message, you access your bank's legitimate site. But because there was malicious code embedded within the URL in the link you clicked, a hacker can now steal your password and the banking information you send during the session. What type of security attack has been perpetrated?

Cross-site scripting

Which of the three general types of cross-site scripting (XSS) exists in a page's client-side script itself, and occurs when a JavaScript program accesses a URL request parameter and uses it to write some X/HTML to its own page?

DOM-based XSS

Output encoding and input validation can help you prevent cross-site scripting attacks. Which of the following is an example of proper output encoding that you can implement?

Encode opening angle brackets ( < ) to the X/HTML entity <

Which of the following practices will help you prevent most cross-site scripting attacks?

Encode output to filter metacharacters

If an end-user encounters an infinite loop in your Web page, what must she do?

Force her browser to quit using CTRL+ALT+DELETE

Which JavaScript security issue invokes the same-origin policy for browser restrictions?

Frame-to-frame URL changing

Which browser layout engine was designed to comply with the W3C and ECMA standards, making it truly cross-platform and able to provide consistent behavior across the operating systems that support it?

Gecko

Which of the following is a popular target for cross-site scripting (XSS) attacks?

Guest book and forum programs

How are cookies sent from a Web page or server to the client system's browser?

In the HTTP response header

An example of accidental or malicious coding is a JavaScript statement that has no attainable conditions for ending, and thus requires the user to close the browser in order to end the script. What is the term for this type of statement?

Infinite loop

Frames are not as commonly used on the Web as they once were, and thus frame-to-frame URL changing is not the problem it once was. However, it does still occur. Which of the following is currently a particular target for frame-to-frame URL changing attacks?

Inline frames

It is important to be able to distinguish between the browser and the operating system in relation to the elements responsible for security. Which of the following describes a function of the operating system?

It allows the computer to interface directly with users.

Which statement is true about a cookie?

It can reside in memory or be placed on a hard drive in the form of a text file.

Which statement about browser compatibility is true?

It is difficult, if not impossible, to create truly cross-browser compatible Web pages.

Many novice developers rely on the document.write method for much of their scripted functionality. Which statement about document.write is true?

It is not necessarily the best way to use JavaScript to write text onto a Web page.

It is important to be able to distinguish between the browser and the operating system in relation to the elements responsible for security. Which of the following describes a function of the browser?

It is one of a few applications that connect your operating system to the unprotected network of the Internet.

Which of the following is an example of JavaScript functionality that can pose a security threat?

JavaScript can bypass certain security features and take privileges with the user's browser by using signed scripts.

Which statement is true about the security of the JavaScript language?

JavaScript has some security features that can help protect users from malicious Web sites by enforcing strict limits on the page authors.

Which statement about JavaScript security is true?

JavaScript sends and receives instructions in cleartext, and can therefore be read by looking at source code.

As you develop your Web pages, there are practices you can follow to ensure that your pages are secure for your users. Which of the following practices could help you repair a zero-day security exploit before your site is compromised?

Keep current in your knowledge about JavaScript and its security.

As you develop your Web pages, there are practices you can follow to ensure that your pages are secure for your users. Which of the following practices helps ensure more security for user-entered data in your database?

Keep security patches up to date.

Which of the following still does not support signed scripts, but rather allows the user to define security zones of trusted sites and specify security settings for the entire zone?

Microsoft Internet Explorer

Which statement is true about mobile browsers and cookies?

Mobile browsers set and store cookies similarly to most standard browsers.

Which statement is true regarding browser-specific secrity issues?

Most versions of most browsers have some security holes.

In addition to some basic information about the browser, such as the application name, vendor and version, which of the following is an environmental variable that you can learn with a client-side detection script?

Patch level for the operating system

Which of the three general types of cross-site scripting (XSS) occurs when a user enters data in the browser, and it is first stored on the server, then later displayed to other users in a Web page without proper X/HTML escaping?

Persistent XSS

With all three types of cross-site scripting (XSS), vulnerability occurs if data — from either the Web page or the user — fails to include what?

Proper X/HTML escaping

There are several alternative coding approaches you can take to develop your Web pages for browser compatibility. Which approach avoids workarounds for non-compliant browsers, giving users a compelling reason to choose only Gecko-based browsers?

Provide only code that supports standards-based browsers.

Which of the following is an example of the functionality of a signed script?

Reading a user's browser preference settings after asking for permission

Which of the three general types of cross-site scripting (XSS) occurs when data provided by a browser is used immediately by server-side scripts to generate a page of results for that user?

Reflected (non-persistent) XSS

Which statement is true in relation to the three general types of cross-site scripting (XSS)?

Reflected (non-persistent) XSS is the most common type of cross-site scripting.

Which term is used to describe a policy that defines the relationships among various pages in a Web site and requires site pages to be ancestors in order to be allowed to navigate each other?

Same origin

You want to clear a cookie that you had previously scripted to be set on your site visitors' browsers. What is an easy way to do this with JavaScript?

Set a new cookie with the same name to replace the old, adding an expiration date that has passed.

Which term is used to describe a program that is allowed to request expanded privileges and abilities in the browser, which may override the usual security?

Signed script

You are browsing the Web, and as you access a particular page, you see a dialog box that advises you of a script that is about to run. The dialog says that this script will install another script and run a related Web page from another site. It then asks for you to agree to allow this script to run. You think you can trust this site, so you click to allow the script.

Signed script

To compromise for connections that can get terminated rather quickly by either the Web server or the user, cookies allow your system to remember connections over time. Thus cookies can remember a user's activities from a previous visit, allowing the user to skip certain steps or return to a site activity where she left off. Which term describes this reason for using cookies?

State maintenance

What does this code do?

Test for the presence of a cookie

It is important to be able to distinguish between the browser and the operating system in relation to the elements responsible for security. Regarding this, which statement is true?

The browser can be considered a doorway for security problems that can affect your operating system.

Client-side detection allows you to tailor your Web pages for optimum viewing in particular browsers. Which JavaScript object can you use to perform client-side detection?

The navigator object

For a signed script to run, the browser must receive a reference to it in the X/HTML page code. For recent browser versions such as Mozilla Firefox, which code is required to reference the signed script?

The src attribute of the <script> tag

Which statement about script-blocking tools is true?

They usually block scripts by default unless you change the settings.

As a developer, why might you need to disable JavaScript completely from your own browser?

To examine a page you are unfamiliar with, possibly because of a security problem

As you develop your Web pages, there are practices you can follow to ensure that the code you create and use in your Web pages is secure for your users. Which of the following development practices helps ensure more secure code?

Understand the code you are using before putting it on a Web site.

As you develop your Web pages, there are practices you can follow to ensure that your pages are secure for your users. Which of the following practices could help protect your site and your users from cross-site scripting attacks?

Use proper encoding and validation practices.

Which choice best describes steps you can take to secure your browser and operating system from threats related to JavaScript?

Use the latest stable version of the software and the latest updates to best protect your operating system, browser and other applications.

Which of the following is an example of a "shared cookie"?

You log in to your favorite social networking site, and are able to play games hosted by another site that you have never visited.

Which of the following is an example of a "cookie crumb"?

You place items in a site's shopping cart but exit the site before purchasing, then return later to find the items still waiting for you in the cart.

You are developing Web pages that feature JavaScript functionality for your site. These pages include a log-in page, and a customer order and payment form. Which security measures are most appropriate?

Your pages should use SSL/TLS and your server should have all the checks in place.

If you use scripts on a site you develop, you should:

advise users about the script and provide alternatives to that functionality.

In relation to security, browser detection:

can provide a hacker with enough information about a system to stage an attack.

A signed script requires the use of a:

digital certificate.

Which of the following JavaScript cookies properly scripts an expiration date?

document.cookie = "myCookie = myValue; expires = Saturday, 31-Dec-2011 06:00:00 GMT";

Which of the following JavaScript cookies properly scripts a URL for cookie access?

document.cookie = "myCookie = myValue; path = /";

Which example demonstrates the general JavaScript syntax to assign a cookie?

document.cookie = "name = value";

The document.write method may perform differently in some browsers because:

in pages with an XHTML doctype, the browser will process as XML, which some browsers have problems displaying.

In regard to security, JavaScript:

is a fairly secure open scripting language.

The lesson gave several examples of known security issues involving browsers and JavaScript. Considering these, you know that security exploits:

may use JavaScript only to mask the exploit.

Which cookie parameter is required?

name=value

A script-blocking add-on or plug-in is generally meant to:

prevent scripts from exploiting security vulnerabilities, but without losing functionality by disallowing all executable content.

The term "cross-site scripting" is appropriate because:

the attacker uses script to load his malicious application from an unrelated, vulnerable site, which is trusted by the user.

A cookie can be scripted to:

track user activities on a server.

Which of the following expressions is an example of a condition that can never be met and would thus cause an infinite loop?

var i = 1; do{ i--;} while (i < 5);