CtrlK
BlogDocsLog inGet started
Tessl Logo

tessl-labs/input-sanitization

Sanitize and validate user input at system boundaries — prevent XSS, SQL

94

1.20x
Quality

89%

Does it follow best practices?

Impact

100%

1.20x

Average score across 6 eval scenarios

SecuritybySnyk

Passed

No known issues

Overview
Quality
Evals
Security
Files

task.mdevals/scenario-5/

Image Thumbnail Generator Service

Problem/Feature Description

A media hosting platform stores user-uploaded images on disk and needs an API that generates thumbnails on demand. The operations team has ImageMagick installed on the server (convert command), and the plan is to use it to produce resized copies of stored images when the frontend requests a specific size.

The service needs to look up an image by a filename provided in the request, verify it exists in the uploads directory, run the resize operation, and return the path to the generated thumbnail. Because this service will be accessible from the internet, the platform's security team has flagged it as high-risk: the filename comes from the user, and the resize is done via an external tool — both are potential attack vectors.

The uploads directory for this service is ./uploads/ relative to the server root. For the purposes of this task, you can pre-populate that directory with a few sample .jpg files to make the service testable.

Output Specification

Build a Node.js (or Python) HTTP service with:

  • GET /api/thumbnail?file=<filename>&width=<px>&height=<px> — locates ./uploads/<filename>, generates a thumbnail at the requested dimensions using ImageMagick's convert command, saves it to ./thumbnails/<output_filename>, and responds with JSON containing the thumbnail path.

The service should handle error cases gracefully (file not found, invalid dimensions) with appropriate HTTP status codes.

Produce:

  • All source files needed to run the service
  • A ./uploads/ directory with at least two sample image files (they can be minimal valid JPEG files)
  • A README.md with startup instructions and an example request

The service should start with npm install && node server.js or the Python equivalent.

evals

tile.json