Qwissit TYPO3

TYPO3 security

XSS, Fluid and content security policy

12 of 60 questions in the app

Fluid output

  1. What does Fluid do by default with a variable such as {comment} in the template? Easy
  2. Which ViewHelper outputs content without any encoding and must never receive user input? Easy
  3. How do you output HTML from the rich text editor safely in Fluid? Easy
  4. What is the ViewHelper f:sanitize.html used for? Easy

Output context

  1. Why is HTML escaping not sufficient for every output context? Easy

Cross-site scripting

  1. What causes most XSS holes in TYPO3 projects? Easy
  2. Can an XSS hole also be built via TypoScript? Easy

Content security policy

  1. What is a content security policy (CSP)? Easy

Fluid output

  1. Does Fluid 5 also HTML-encode automatically in a .txt mail template? Medium
  2. How do you switch off escaping for a whole Fluid template? Medium

Fluid output

  1. A guestbook outputs entries with <f:format.raw>{entry.text}</f:format.raw>. Which corrections close the hole? Hard
  2. A template writes <script>var name = "{user.name}";</script>. Which assessment is correct? Hard

Certifications & exams

Which exam comes next?

You can already practise for 19 exams, and 21 are up for a vote. See all certifications with their official information, cast your vote or suggest your exam.

See all certifications