Pick the most accurate example of an attack surface from your list that commonly leads to RCE if mishandled:
Cookies with HttpOnly
set
Search box with client-side validation only
CSP with default-src 'self'
File upload functions without validation
This question is part of this quiz :
Cyber Quiz Day 29