I am working on an application where user can send in an absolute path of an image or URL as string in API endpoint. My code is able to handle that.

Now I have been asked to add the code which can handle byte stream in string format. How can I do this and is it advisable to make this type of end point? Shouldn't it pose a security risk? This code will go to production environment in few months.

  • Images/files uploaded to web sites as byte arrays for decades... What exact security concerns do you have in mind in addition to the regular once about handling of untrusted users' data? (It is unclear what you mean "my code can handle absolute paths and urls" - but generally obtaining data from urls provided by user has more treats compared to when all the data comes directly in the request... so it is interesting what additional threats you see in your case) Feb 10, 2021 at 2:34
  • Yeah you are right. I guess I just over thought the whole thing. Feb 10, 2021 at 5:35

1 Answer 1


All user data sent to you end up in bytes. Even the strings. Taking the data as not-strings rather than as strings only means you’re taking them as something else. So long as you understand that something else as well as you understand strings there’s no problem with bytes.

However, user data shouldn’t be trusted. It should be validated to ensure it only has expected values. That’s true if it’s strings or not-strings.

I’m actually more concerned about letting users hand you file paths unrestricted.

  • Ooof. Well I have to raise all of these concerns. Thanks for the input. Feb 10, 2021 at 5:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.