XSS, CSRF & Injection — Series 3

Preview — 3 of 10 questions

A report endpoint accepts a sort column from the client:

javascript

const rows = await db.$queryRaw`
  SELECT id, total FROM orders
  WHERE user_id = ${userId}
  ORDER BY ${sortColumn}
`;

AIt is safe — the tagged template parameterises every interpolation.

BuserId is parameterised, but sortColumn is an identifier: placeholders bind values, not table or column names, so it must be validated against an allow-list.

CIt is safe as long as sortColumn is escaped with quotes.

DIt is unsafe only if userId comes from the request.

/api/admin/users checks if (!session) return 401, and the admin link is only rendered for admins. What is the flaw?

ANone — the UI never shows the link to non-admins.

BThe route should also verify the Referer header.

CThe route needs a CSRF token.

DAny authenticated user can call the endpoint directly; the role check exists only in the UI, and the server must enforce it itself.

A fetch preview from URL feature must not reach internal services. Which control works?

AResolve the hostname, reject private and link-local address ranges, re-check the address actually connected to, and disable redirects — or route the request through an egress proxy that enforces the allow-list.

BReject any URL whose hostname contains localhost or starts with 10..

COnly allow https://, since internal services run on plain HTTP.

DStrip the Host header before sending the request.

Answer all 10 questions (7 more), see explanations for every answer, and track your score.