A web application has a file download endpoint: GET /api/download?file=report_2024.pdf. An attacker submits ?file=../../../../etc/shadow. The server reads and returns the file. Which OWASP vulnerability enables this and what is the first line of defense?

• A.Path Traversal (related to OWASP A01 Broken Access Control) - the attacker uses '../' sequences to escape the intended directory. First defense: canonicalize the path and verify it starts with the allowed base directory after resolution; second: use an allowlist of permitted filenames rather than accepting arbitrary paths
• B.Unrestricted File Download (related to A04 Insecure Design) - the endpoint returns any file name the client supplies without a business rule. First defense: store the files in a database blob instead of the file system; second: add a per-user rate limit on the download endpoint and log each request together with the source address of the caller
• C.Insecure Direct Object Reference (related to OWASP A07 Authentication Failures) - the file name is a guessable identifier. First defense: replace the file name with a sequential numeric id; second: require a session cookie on the download endpoint and log each request together with the user agent string