Oracle Certified Professional Java Se 11 Developer · Free Practice Question Easy
Question 81
Question ID: UKOCP80738
Given code:
- package com.udayankhattry.ocp;
- import java.security.AccessController;
- import java.security.PrivilegedAction;
- public class PropertyReader {
- public static String get(final String key) {
- PrivilegedAction<String> pa = () -> System.getProperty(key);
- return AccessController.doPrivileged(pa);
- }
- }
Which of the following statements is correct?
- A It may cause code injections
- B It may cause DoS attack
- C Incorrect input validation
- D Clone/Copy of value is not returned
Reveal correct answer
Correct answer: C
Explanation
UKOCP80738:
Interface PrivilegedAction<T> is a functional interface and it has below method:
T run();
In this case, lambda expression should implement String run(); method.
This is an example of tainted input, where use can specify, which value they want to get.
If your code depends upon user-specified key, then verify that it belongs to a set of predefined keys.
Check below link and section:
https://www.oracle.com/java/technologies/javase/seccodeguide.html
Guideline 9-3 / ACCESS-3: Safely invoke java.security.AccessController.doPrivileged
Given code is not prone to any of the code injections (SQL injection, JavaScript injection or XML injection).
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
