A municipal template engine includes remote URLs supplied by users when rendering pages. What risk class should the tester flag?
Select an answer to reveal the explanation.
Short Explanation
Letting strangers pick what the server pulls in is like letting them choose the next tape for the projector. Remote file inclusion means the app may fetch and run attacker-hosted content. Flag the class and impact path — do not ship a PoC payload cookbook.
Full Explanation
When a municipal template engine includes remote URLs supplied by users while rendering pages, the risk class is remote file inclusion that can lead toward attacker-controlled code execution themes. User-influenced remote includes let an adversary host malicious content that the server fetches and interprets—far beyond cosmetic page issues for citizen-facing portals.
Clickjacking from missing frame-ancestors alone is a framing control gap, not RFI. Weak TLS on a mail relay and missing HSTS on marketing sites are separate hygiene items that do not describe remote includes in the template engine.
Exam caveat: RFI vs LFI hinges on whether the include target can be remote; disable remote includes and avoid passing user URLs into include/render APIs. CPTS web judgment emphasizes unsafe dynamic includes as high severity for civic apps.
Operational check: disable remote URL includes in the template configuration, allowlist local templates only, monitor outbound fetch anomalies from app servers, and verify user-supplied URLs cannot influence server-side include paths. Template engines used for municipal pages should load only local trusted templates; treat user URLs as data to display, never as include targets.