Drupal Drupal Performance & Security 2 — Questions and Answers
Question 1: What is the primary mechanism Drupal's Database API uses to prevent SQL injection attacks?
- Regular expression validation on all user input before database operations
- Prepared statements that separate SQL structure from user-supplied data (Correct answer)
- Escaping query strings with PHP's htmlspecialchars() function
- Whitelisting allowed characters in all form field values
Correct answer: Prepared statements that separate SQL structure from user-supplied data
Drupal's Database API uses prepared statements (parameterized queries) so user-supplied data is never interpreted as SQL code, eliminating SQL injection vulnerabilities.
Question 2: Which Drupal utility class should developers use to sanitize user-supplied text before rendering it in HTML to prevent XSS?
- PHP's built-in strip_tags() function
- PHP's built-in htmlspecialchars() function
- Drupal's Xss::filter() or Html::escape() from the Drupal\Component\Utility namespace (Correct answer)
- WordPress's sanitize_text_field() ported to Drupal
Correct answer: Drupal's Xss::filter() or Html::escape() from the Drupal\Component\Utility namespace
Drupal provides Xss::filter() for allowing a safe subset of HTML tags and Html::escape() for encoding all HTML entities, which are the correct API-level tools for XSS prevention in Drupal.
Question 3: What attack does the 'trusted_host_patterns' setting in Drupal's settings.php guard against?
- SQL injection via crafted hostname values
- HTTP Host header injection that can enable cache poisoning or manipulated password reset links (Correct answer)
- Cross-site request forgery via the referer header
- Brute-force login attacks from specific IP ranges
Correct answer: HTTP Host header injection that can enable cache poisoning or manipulated password reset links
trusted_host_patterns restricts which Host header values Drupal will accept, preventing attackers from injecting a malicious hostname that could redirect password reset emails or poison shared caches.
Question 4: How does Drupal's Form API automatically protect against Cross-Site Request Forgery (CSRF)?
- It requires all forms to be submitted over HTTPS only
- It adds a unique token to every form and validates it on submission (Correct answer)
- It limits form submissions to users who have been active within the last 30 minutes
- It encrypts all form field values with a session-specific key
Correct answer: It adds a unique token to every form and validates it on submission
Drupal's Form API automatically embeds a unique CSRF token in every form and rejects submissions where the token is missing or doesn't match the user's session.
Question 5: What is the purpose of Drupal Security Advisories labeled 'SA-CORE'?
- Announcing major new features added to Drupal core releases
- Officially disclosing and providing patches for security vulnerabilities found in Drupal core (Correct answer)
- Rating the overall security posture of specific Drupal site configurations
- Publishing developer best practices from the Drupal Association
Correct answer: Officially disclosing and providing patches for security vulnerabilities found in Drupal core
SA-CORE advisories are formal disclosures published by the Drupal Security Team that describe vulnerabilities in Drupal core and are always paired with a security release containing the fix.
Question 6: What is the primary function of Drupal's Update Manager module from a security perspective?
- It automatically downloads and applies security patches without administrator action
- It checks drupal.org for available updates and alerts administrators when security releases are available (Correct answer)
- It enforces mandatory updates by blocking site access until patches are applied
- It scans installed modules for known vulnerable code patterns
Correct answer: It checks drupal.org for available updates and alerts administrators when security releases are available
The Update Manager module periodically checks for available updates to Drupal core and contributed modules and notifies administrators via the dashboard and email, especially highlighting security updates.
Question 7: What does the principle of 'least privilege' mean when assigning Drupal user roles?
- Users should receive only the minimum permissions required to perform their assigned tasks (Correct answer)
- Anonymous users must always have fewer permissions than authenticated users
- Administrators should create separate accounts for privileged versus routine operations
- New users should start with no permissions and formally request access upgrades
Correct answer: Users should receive only the minimum permissions required to perform their assigned tasks
Least privilege means granting each role only the specific permissions needed for its responsibilities, limiting the blast radius if an account is compromised or misused.
Drupal Drupal Performance & Security 2
What is the primary mechanism Drupal's Database API uses to prevent SQL injection attacks?