Code reviewHardcr-g448

Subject Path traversalLevel Senior–Staff~24 minCommon in Code quality & review interviewsIndustries Software development

Question

Review this Java file-serving endpoint that already normalizes and prefix-checks the path.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1File serve(String name) throws IOException {2    File base = new File("/srv/files");3    File target = new File(base, name).getCanonicalFile();4    if (!target.getPath().startsWith(base.getCanonicalPath())) {5        throw new SecurityException("escape");6    }7    return target; // streamed to the client8}

Run or narrate your approach, then ask the coach.