Question
A programmer is reviewing the following proprietary piece of code that was identified as a vulnerability due to users being authenticated when they provide incorrect credentials:
```
GET USERID
GET PASS
JUMP TO :ALLOWUSER:
IF USERID == GETDBUSER(USERID) AND HASH(PASS) == GETDBPASS(USERID)
EXIT
:ALLOWUSER:
SET USERACL(USERID)
...
...
...
```
Which of the following should the programmer implement to remediate the code vulnerability?
- A. Salted hashing via the proprietary SHASH function
- B. Input validation in the first two lines of code Correct
- C. Atomic execution of subroutines
- D. TOCTOU remediation in SET USERACL
- E. Database connection over encrypted channels
Explanation
The user ID and password are read in the first two lines and then used without any validation, so the flow reaches the ALLOWUSER label and grants access even when the supplied credentials are wrong. Validating the input when it is collected, and only continuing when the credentials are confirmed, closes that path. Salted hashing and encrypted database connections protect stored or transmitted credentials but do not change the flawed flow, and there is no shared resource or time gap that atomic execution or TOCTOU remediation would address.
