A web application has a file download endpoint: GET /api/download?file=report_2024.pdf. An attacker submits ?file=../../../../etc/shadow. The server reads and returns the file. Which OWASP vulnerability enables this and what is the first line of defense?

• A.Path Traversal (related to OWASP A01 Broken Access Control) - the attacker uses '../' sequences to escape the intended directory. First defense: canonicalize the path and verify it starts with the allowed base directory after resolution; second: use an allowlist of permitted filenames rather than accepting arbitrary paths
• B.SQL injection via the file parameter; SSRF against cloud metadata endpoints was fixed platform-wide by IMDSv2, which every AWS account enforces retroactively; the same-origin policy stops SQL injection originating from the browser, which is why injection is mainly an API problem; insecure deserialization is limited to Java, as JSON-based stacks cannot execute code during parsing by design
• C.