1answer.
Ask question
Login Signup
Ask question
All categories
  • English
  • Mathematics
  • Social Studies
  • Business
  • History
  • Health
  • Geography
  • Biology
  • Physics
  • Chemistry
  • Computers and Technology
  • Arts
  • World Languages
  • Spanish
  • French
  • German
  • Advanced Placement (AP)
  • SAT
  • Medicine
  • Law
  • Engineering
Nataly_w [17]
3 years ago
13

Consider the following general code for allowing access to a resource:

Computers and Technology
1 answer:
Margaret [11]3 years ago
6 0

Answer:

a) The code allows access even when  IsAccessAllowed(...) method fails.

b) Either use If

(dwRet = ACCESS_ALLOWED)

or use

if (dwRet == NO_ERROR)

to avoid flaw

Explanation:

Lets first see what the code chunk does:

DWORD dwRet = IsAccessAllowed(...);

if (dwRet == ERROR_ACCESS_DENIED) {

// Security check failed.

// Inform user that access is denied.

} else {

// Security check OK.

}

In the given code, DWORD is basically a data type for double word type integers and this is defined in windows.h

So there is DWORD type variable dwRet that is assigned a method calls.

The method is IsAccessAllowed() which checks if the access is allowed to user.

if (dwRet == ERROR_ACCESS_DENIED) condition basically checks if the value of DWORD type variable dwRet is equal to ERROR_ACCESS_DENIED

If this condition evaluates to true then the security checks fails and user is informed via some message or action that the access is denied.  But when the if condition evaluates to false then the else part executes which allows access.

So basically this chunk of code checks if the error ERROR_ACCESS_DENIED is returned.

Now the flaw in this program is what if the method IsAccessAllowed() by any reason. The reasons can be system failure or the memory failure. In memory failure case for example, the system returns out of memory error. So this means that the error is not  ERROR_ACCESS_DENIED. Instead it is out of memory error. So in such a case the user is allowed access as the if condition evaluates to false and else part executes. So if any other error is produced due to some reason like mentioned above, then user has unrestricted access.

This shows that the doe should not check for the failure or rely on checking ERROR_ACCESS_DENIED to allow access but instead it should check for success. Code should only give access privilege if access is allowed successfully or no error is produced.

So to avoid this flaw the code is altered as:

DWORD dwRet = IsAccessAllowed(...);

If (dwRet = ACCESS_ALLOWED) {

//Security check OK.

} else {

//Security check failed.

//Inform user that access is denied.

}

This will only allow access if ACCESS_ALLOWED evaluates to true and success is checked instead of failure here

You can also alter the if condition as:

If (dwRet = No_Error)

or

If (dwRet = 0)

The above if conditions checks if the access is allowed or if no error is produced. Only then it will allowed access otherwise not. So the access check is a success is checked first and failure (for any reason). The user is allowed access only if there is no error otherwise user is not allowed access.

You might be interested in
The femur is _____.<br><br> part of a cell<br> the thigh bone<br> a hair follicle<br> a muscle
MA_775_DIABLO [31]

Its the Thigh Bone. Hope this helps. =^-^=

7 0
2 years ago
Whats the best strategy for avoiding ATM fees?
natulia [17]
You hack the atm that's how
3 0
3 years ago
Read 2 more answers
Game Design 40 POINTS. Help Please. If you help then you are godly.
Brrunno [24]

question 4 is b

question 3 is also b

last one A

5 0
2 years ago
The type of code that uses eight bits for each character is ____.
Ksivusya [100]
It's Binary code simple as that its made of 8 1's and 0's
7 0
3 years ago
Suppose we want to compress a text consisting of 6 characters,a, b, c, d, e, fusingthe Huffman Algorithm. Give an example for wh
denis-greek [22]

Answer:

Check the explanation

Explanation:

When it comes to the field of computer science and information theory, the Huffman code is a specific type of optimal prefix code that is mostly utilized for the compression of lossless data. The process and procedures of finding or using such a code proceeds by means of Huffman coding, which is an algorithm that was developed by David A.

kindly check the below image for the complete answer to your question.

8 0
3 years ago
Other questions:
  • 7.8.1: Function pass by reference: Transforming coordinates. Define a function CoordTransform() that transforms the function's f
    6·1 answer
  • What exactly is a byte? A byte is a term that is short for binary digit. 8 bytes hold about one letter, one number, or one speci
    10·1 answer
  • Which three features can be configured in the BIOS settings to secure a computer?
    12·1 answer
  • Please help!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    12·2 answers
  • Mation about which osi layers of connected cisco devices can be verified with the show cdp neighbors comm
    15·1 answer
  • The use of IDPS sensors and analysis systems can be quite complex. One very common approach is to use an open source software pr
    9·2 answers
  • ¿Que es la energía? (una sola respuesta es la correcta)
    11·1 answer
  • Please help with question
    14·1 answer
  • The Backstage view is where you can see information and options pertaining to the user account and settings. How is the Backstag
    14·1 answer
  • TRUE/FALSE. a good with many close substitutes is likely to have relativelyelastic correct demand, since consumers can easily ch
    13·1 answer
Add answer
Login
Not registered? Fast signup
Signup
Login Signup
Ask question!