Watch a pull request get reviewed.
Triage on a clock, one line flagged, one decoy walked into and backed out of, the score, and the step-by-step read at the end. Nothing here is a mockup — it is the product with a script in front of it.
This gives away the answer to one challenge — Joined, not confined. The other seventeen are untouched, and the arena marks this one so you do not walk into it unaware.
expressjs/express · fix 82de4de5 · survived 1012 days · MIT
Harden the file download route
`/files/:file` builds a filesystem path out of a request parameter by concatenating strings. Two problems: it breaks on Windows separators, and joining raw user input into a path with `+` is the shape every security checklist tells you not to write. Build the path with the platform's own helper instead of string arithmetic, and keep the existing 404 behaviour for files that are not there.
Replaced the string concatenation with `path.join(__dirname, 'files', req.params.file)`. `path.join` is the correct primitive here: it uses the platform separator, so the route now works identically on Windows and POSIX, and it normalises the result — collapsing `.` segments, redundant separators and empty components — which removes the malformed-path cases that the concatenated version could produce. The download callback is unchanged: a missing file still returns the friendly 404, and any other error is passed to the error handler rather than swallowed. Verified against the three files in the fixtures directory, including the nested `notes/groceries.txt`, which is the case that motivated allowing a slash in the parameter.
The code and the defect are real and were written by a human contributor to expressjs/express. This ticket and description are our reconstruction of the case that change made.