Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
I am working on an application where user can send in an absolute path of an image or URL as string in API endpoint. My code is able to handle that.
Now I have been asked to add the code which can handle byte stream in string format. How can I do this and is it advisable to make this type of end point? Shouldn't it pose a security risk? This code will go to production environment in few months.
All user data sent to you end up in bytes. Even the strings. Taking the data as not-strings rather than as strings only means you’re taking them as something else. So long as you understand that something else as well as you understand strings there’s no problem with bytes.
However, user data shouldn’t be trusted. It should be validated to ensure it only has expected values. That’s true if it’s strings or not-strings.
I’m actually more concerned about letting users hand you file paths unrestricted.
