Code reviewHardcr-g040

Subject Insecure deserializationLevel Senior–Staff~30 minCommon in Distributed systems interviewsIndustries Software development

Question

Review this Java endpoint that accepts a serialized 'preferences' blob.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1@PostMapping("/prefs/import")2public ResponseEntity<String> importPrefs(@RequestBody byte[] body) throws Exception {3    try (ObjectInputStream ois =4             new ObjectInputStream(new ByteArrayInputStream(body))) {5        UserPrefs prefs = (UserPrefs) ois.readObject();6        prefsService.apply(prefs);7        return ResponseEntity.ok("imported");8    }9}

Run or narrate your approach, then ask the coach.