A parks permitting form relies on legacy CGI wrappers that invoke OS commands. Before AI helps craft authorized tests, which identification best flags command-injection exposure?
Select an answer to reveal the explanation.
Short Explanation
Old CGI that funnels form fields into shell wrappers is a classic 'please inject me' pattern. HTTPS and 'CGI is fine' myths do not magically sanitize OS calls.
Full Explanation
Legacy CGI wrappers that invoke OS commands with form field input are a classic command-injection-prone pattern. Before AI helps craft authorized tests for a parks permitting form, testers should identify that pattern so subsequent AI-aided case generation targets the real sink—unsanitized pass-through into shell or OS wrappers—rather than random form cosmetics. Correct identification focuses effort and clarifies why input validation, allowlists, and avoiding shell-outs matter on municipal legacy stacks.
Claiming any HTTPS form is immune to command injection confuses transport encryption with input handling; TLS does not sanitize shell concatenation. Asserting only JSON APIs can suffer command injection while CGI is automatically safe is historically backwards: CGI command wrappers are among the oldest web CMDi teaching examples. Requiring physical desktop access and denying web-form command injection misstates the attack path entirely.
Exam caveat: pattern-ID stems about CGI + OS wrappers point to command-injection exposure; HTTPS or 'CGI is safe' myths are distractors. Operational check: map form fields to any CGI/OS wrapper, confirm whether arguments are escaped or allowlisted, and only then use AI to help design authorized, minimal-impact tests for that sink.