Question 690
At fictional Alder Distribution, the Business Central development team is supporting wholesale order fulfillment and reviewing external-service integration during a tenant acceptance test (MB820-6.1-187). The observed development issue is that a team builds the service URL by concatenating unchecked customer text into query parameters. Which recurring engineering check would best prevent this issue from returning?
Explanation
Correct Answer
The ongoing check is to test URL encoding and parameter injection cases. This helps detect recurrence when a team builds the service URL by concatenating unchecked customer text into query parameters. The associated correction is to validate input and use appropriate URI encoding for outbound requests; a confirming result is that special characters do not change the endpoint or insert unexpected parameters.
Incorrect Answers
“Include arrays with zero, one and many items in regression tests” supports the separate task “inspect JSON token types and iterate JsonArray elements using supported AL JSON APIs”, not the reported problem: a team builds the service URL by concatenating unchecked customer text into query parameters. This case instead calls for “Test URL encoding and parameter injection cases”.
“Test timeouts and circuit-breaker behavior on critical workflows” concerns the alternative task “set an appropriate request timeout and implement a bounded failure path or asynchronous design where needed”, but the stated failure is that a team builds the service URL by concatenating unchecked customer text into query parameters. The required measure is to test URL encoding and parameter injection cases.
The proposed “Scan extension packages and telemetry for credential material” tests a different control: use supported secret storage or secure authorization flow rather than embedding the token in source. The reported condition is that a team builds the service URL by concatenating unchecked customer text into query parameters; the more direct action is to test URL encoding and parameter injection cases.