Symlink escapes base directory

Code reviewCode quality & reviewMid–Senior~20 min

Review this Node.js (Express) file-download route.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1const BASE = '/var/app/user_uploads';

3app.get('/files/:name', (req, res) => {

4 const name = req.params.name;

5 if (name.includes('..')) {

6 return res.status(400).send('nope');

7 }

8 const full = path.join(BASE, name);

9 fs.createReadStream(full)

10 .on('error', () => res.status(404).end())

11 .pipe(res);

12});

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.