Code reviewHardcr-g255

Subject SsrfLevel Senior–Staff~35 minCommon in Code quality & review interviewsIndustries Software development

Question

Review this Java internal-API proxy with a host allowlist.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1public String proxy(String rawUrl) throws Exception {2    URL u = new URL(rawUrl);3    if (!u.getHost().endsWith("trusted.internal.example.com")) {4        throw new SecurityException("host not allowed");5    }6    HttpURLConnection c = (HttpURLConnection) u.openConnection();7    c.setInstanceFollowRedirects(true);8    return new String(c.getInputStream().readAllBytes());9}

Run or narrate your approach, then ask the coach.