Code reviewMediumcr-g027

Subject Path traversalLevel Mid–Senior~20 minCommon in Code quality & review interviewsIndustries Software development

Question

Review this Node.js (Express) file-download route.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjs

1const BASE = '/var/app/user_uploads';2 3app.get('/files/:name', (req, res) => {4  const name = req.params.name;5  if (name.includes('..')) {6    return res.status(400).send('nope');7  }8  const full = path.join(BASE, name);9  fs.createReadStream(full)10    .on('error', () => res.status(404).end())11    .pipe(res);12});

Run or narrate your approach, then ask the coach.