Code reviewMediumcr-g446

Subject Insecure deserializationLevel Mid–Senior~18 minCommon in ML systems interviewsIndustries Software development, Technology

Question

Review this Python endpoint that loads a user-uploaded YAML pipeline definition.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewpython

1import yaml2 3@app.route('/pipelines', methods=['POST'])4@login_required5def create_pipeline():6    uploaded = request.files['spec'].read()7    spec = yaml.load(uploaded, Loader=yaml.Loader)8    steps = spec.get('steps', [])9    commands = [s['run'] for s in steps]10    pipeline_id = store.save(owner=current_user.id, steps=commands)11    return {'id': pipeline_id, 'steps': len(commands)}

Run or narrate your approach, then ask the coach.