CtrlK
BlogDocsLog inGet started
Tessl Logo

tessl-labs/input-sanitization

Sanitize and validate user input at system boundaries — prevent XSS, SQL

94

1.20x
Quality

89%

Does it follow best practices?

Impact

100%

1.20x

Average score across 6 eval scenarios

SecuritybySnyk

Passed

No known issues

Overview
Quality
Evals
Security
Files

task.mdevals/scenario-1/

Product Catalog Search API

Problem/Feature Description

A small e-commerce startup is building a product catalog service. Their backend team has a working database with a products table, but they need a REST API that lets the frontend filter products by name (partial text match), category, and price range. The team has been burned before by a security incident where user input made its way directly into database queries, so the new implementation must be done carefully.

The catalog currently stores thousands of items across categories like "electronics", "clothing", "food", and "books". The frontend needs to pass a search term to find products whose names contain a substring, optionally filter by category, and optionally filter by a minimum and maximum price. Individual products should also be retrievable by their numeric ID.

Output Specification

Build a Node.js (or Python) REST API with the following endpoints:

  • GET /api/products — returns a list of products, supporting query parameters:
    • search (string, optional) — filter products whose name contains this substring
    • category (string, optional) — filter by exact category match
    • min_price (number, optional) — minimum price (inclusive)
    • max_price (number, optional) — maximum price (inclusive)
  • GET /api/products/:id — returns a single product by its numeric ID

Use an ORM of your choice (Prisma, Sequelize, SQLAlchemy, etc.) with an in-memory or file-based SQLite database so the API can be started and tested without any external services.

Produce:

  • All source files needed to run the API
  • A README.md describing how to start the server and example requests
  • A schema.sql or migration file showing the products table definition

The API should start cleanly with npm install && npm start (or the Python equivalent) and return JSON responses.

evals

scenario-1

criteria.json

task.md

tile.json