SVIG/python-bootcamp
7
0
Fork 1
Code Issues Pull Requests 1 Releases Wiki Activity

Update page 'Day 2 homework - Sloetjes'

xuanyi.wang
2023-03-31 18:22:35 +02:00
parent dbb33df791
commit 866464bcdf
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Day 2 homework - Sloetjes.md
+1 -1
@@ -142,7 +142,7 @@ One way someone might try to hide an embezzlement scheme using the answers to th
For example, if a banking application outputs transaction details to a web page, an attacker might use a script or tool to intercept the response and replace the transaction amount with a smaller value, followed by the `"\r"` character, and then a larger value. When a developer or system administrator tries to troubleshoot the issue by viewing the console output, they will see the larger value and assume that the transaction was processed correctly, while in reality the attacker has embezzled funds by manipulating the output. For example, if a banking application outputs transaction details to a web page, an attacker might use a script or tool to intercept the response and replace the transaction amount with a smaller value, followed by the `"\r"` character, and then a larger value. When a developer or system administrator tries to troubleshoot the issue by viewing the console output, they will see the larger value and assume that the transaction was processed correctly, while in reality the attacker has embezzled funds by manipulating the output.
**##### 9. Think of how you would do input validation to prevent such a crime. Replace the code REPLACE ME here so the tests pass: **9. Think of how you would do input validation to prevent such a crime. Replace the code REPLACE ME here so the tests pass:
** **
##### Answer: ##### Answer:
To prevent the use of the `"\r"` character for hiding malicious input, we can modify the `validate()` function to explicitly disallow it: To prevent the use of the `"\r"` character for hiding malicious input, we can modify the `validate()` function to explicitly disallow it: