From 866464bcdf172964e65a15a5187b2dee38d257ad Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Fri, 31 Mar 2023 18:22:35 +0200 Subject: [PATCH] Update page 'Day 2 homework - Sloetjes' --- Day 2 homework - Sloetjes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Day 2 homework - Sloetjes.md b/Day 2 homework - Sloetjes.md index 6d6afcc..f15195b 100644 --- a/Day 2 homework - Sloetjes.md +++ b/Day 2 homework - Sloetjes.md @@ -142,7 +142,7 @@ One way someone might try to hide an embezzlement scheme using the answers to th For example, if a banking application outputs transaction details to a web page, an attacker might use a script or tool to intercept the response and replace the transaction amount with a smaller value, followed by the `"\r"` character, and then a larger value. When a developer or system administrator tries to troubleshoot the issue by viewing the console output, they will see the larger value and assume that the transaction was processed correctly, while in reality the attacker has embezzled funds by manipulating the output. -**##### 9. Think of how you would do input validation to prevent such a crime. Replace the code REPLACE ME here so the tests pass: +**9. Think of how you would do input validation to prevent such a crime. Replace the code REPLACE ME here so the tests pass: ** ##### Answer: To prevent the use of the `"\r"` character for hiding malicious input, we can modify the `validate()` function to explicitly disallow it: