SSRF via image URL
Review this Python image-import endpoint.
What a strong answer looks like
Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.
0:00 of about 30 min
Mark a line and say what kind of problem it is.0 findings
1import requests
2from flask import request, jsonify
3
4@app.route('/import-avatar', methods=['POST'])
5def import_avatar():
6 url = request.json['image_url']
7 if not url.startswith('http'):
8 return jsonify(error='invalid'), 400
9 resp = requests.get(url, timeout=5)
10 data = resp.content
11 key = upload_to_storage(data)
12 return jsonify(key=key)
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.