From 9e2c908fae11e2e8aa6770586969cd1b369e065b Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Fri, 31 Mar 2023 18:23:02 +0200 Subject: [PATCH] Update page 'Day 2 homework - Sloetjes' --- Day 2 homework - Sloetjes.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Day 2 homework - Sloetjes.md b/Day 2 homework - Sloetjes.md index f15195b..0d34dc3 100644 --- a/Day 2 homework - Sloetjes.md +++ b/Day 2 homework - Sloetjes.md @@ -142,8 +142,8 @@ One way someone might try to hide an embezzlement scheme using the answers to th For example, if a banking application outputs transaction details to a web page, an attacker might use a script or tool to intercept the response and replace the transaction amount with a smaller value, followed by the `"\r"` character, and then a larger value. When a developer or system administrator tries to troubleshoot the issue by viewing the console output, they will see the larger value and assume that the transaction was processed correctly, while in reality the attacker has embezzled funds by manipulating the output. -**9. Think of how you would do input validation to prevent such a crime. Replace the code REPLACE ME here so the tests pass: -** +**9. Think of how you would do input validation to prevent such a crime. Replace the code REPLACE ME here so the tests pass:** + ##### Answer: To prevent the use of the `"\r"` character for hiding malicious input, we can modify the `validate()` function to explicitly disallow it: