Code reviewMediumcr-g026

Subject SsrfLevel Mid–Senior~25 minCommon in Code quality & review interviewsIndustries Software development

Question

Review this Node.js (Express) image-proxy used to thumbnail remote images.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjs

1app.get('/thumb', async (req, res) => {2  const src = req.query.src;3  // only allow our CDN to avoid abuse4  if (!src.startsWith('https://cdn.example.com')) {5    return res.status(400).send('bad source');6  }7  const upstream = await fetch(src);8  const buf = Buffer.from(await upstream.arrayBuffer());9  const png = await sharp(buf).resize(200).png().toBuffer();10  res.type('png').send(png);11});

Run or narrate your approach, then ask the coach.