LARAVEL Risk Assessment & Management 3 — Questions and Answers
Question 1: A Laravel application allows users to upload files. Which validation rule combination best mitigates malicious upload risks?
- required|string|max:255
- required|file|mimes:jpg,png,pdf|max:2048 (Correct answer)
- required|url|active_url
- required|image|nullable
Correct answer: required|file|mimes:jpg,png,pdf|max:2048
Combining file, mimes (allowlist of extensions), and max (size cap) prevents executable uploads and oversized payloads.
Question 2: What risk does mass assignment pose in Laravel Eloquent, and what is the correct mitigation?
- It causes N+1 queries; use eager loading
- It allows attackers to set arbitrary model attributes; use $fillable or $guarded to restrict which fields can be set (Correct answer)
- It bypasses authentication; use auth middleware
- It leaks query logs; disable DB logging
Correct answer: It allows attackers to set arbitrary model attributes; use $fillable or $guarded to restrict which fields can be set
Without $fillable or $guarded, a crafted POST request can set fields like is_admin, leading to privilege escalation.
Question 3: Which Laravel rate-limiting approach best reduces the risk of brute-force login attacks?
- Applying the throttle:6,1 middleware to login routes (Correct answer)
- Using DB transactions on the login controller
- Encrypting the password field in transit with openssl
- Adding a unique index on the email column
Correct answer: Applying the throttle:6,1 middleware to login routes
The throttle middleware limits requests per minute per IP, blocking repeated rapid attempts that characterize brute-force attacks.
Question 4: How should Laravel applications handle third-party JavaScript dependencies to reduce XSS supply-chain risk?
- Load all scripts from public CDNs without integrity checks
- Use Subresource Integrity (SRI) hashes on CDN script tags (Correct answer)
- Store JS files directly in the database
- Disable JavaScript in the Blade templates
Correct answer: Use Subresource Integrity (SRI) hashes on CDN script tags
SRI hashes cause the browser to reject a script if its content has changed, protecting against CDN compromise.
Question 5: What is the security risk of using Laravel's `response()->download()` with user-supplied file paths without validation?
- It increases response time
- It can expose arbitrary server files via path traversal attacks (Correct answer)
- It disables caching headers
- It forces synchronous disk I/O
Correct answer: It can expose arbitrary server files via path traversal attacks
An attacker could supply paths like ../../etc/passwd to read files outside the intended directory.
Question 6: Which Laravel configuration option, when enabled, sends all outgoing emails to a single address — a key risk control in staging environments?
- MAIL_MAILER=log
- MAIL_TO_ADDRESS in combination with a global 'to' override (Correct answer)
- MAIL_ENCRYPTION=none
- MAIL_HOST=localhost
Correct answer: MAIL_TO_ADDRESS in combination with a global 'to' override
Setting a global 'to' recipient in config/mail.php redirects all mail to a test address, preventing accidental delivery to real users.
Question 7: A developer uses `{!! $userInput !!}` instead of `{{ $userInput }}` in a Blade template. What risk does this introduce?
- Double encoding of HTML entities
- Stored or reflected XSS because output is not escaped (Correct answer)
- CSRF token regeneration on every request
- Increased query execution time
Correct answer: Stored or reflected XSS because output is not escaped
The `{!! !!}` syntax outputs raw HTML without escaping, meaning any scripts in user input execute in the browser.
LARAVEL Risk Assessment & Management 3
A Laravel application allows users to upload files.
Which validation rule combination best mitigates malicious upload risks?