Sanitize and validate user input at system boundaries — prevent XSS, SQL
94
89%
Does it follow best practices?
Impact
100%
1.20xAverage score across 6 eval scenarios
Passed
No known issues
A media hosting platform stores user-uploaded images on disk and needs an API that generates thumbnails on demand. The operations team has ImageMagick installed on the server (convert command), and the plan is to use it to produce resized copies of stored images when the frontend requests a specific size.
The service needs to look up an image by a filename provided in the request, verify it exists in the uploads directory, run the resize operation, and return the path to the generated thumbnail. Because this service will be accessible from the internet, the platform's security team has flagged it as high-risk: the filename comes from the user, and the resize is done via an external tool — both are potential attack vectors.
The uploads directory for this service is ./uploads/ relative to the server root. For the purposes of this task, you can pre-populate that directory with a few sample .jpg files to make the service testable.
Build a Node.js (or Python) HTTP service with:
GET /api/thumbnail?file=<filename>&width=<px>&height=<px> — locates ./uploads/<filename>, generates a thumbnail at the requested dimensions using ImageMagick's convert command, saves it to ./thumbnails/<output_filename>, and responds with JSON containing the thumbnail path.The service should handle error cases gracefully (file not found, invalid dimensions) with appropriate HTTP status codes.
Produce:
./uploads/ directory with at least two sample image files (they can be minimal valid JPEG files)README.md with startup instructions and an example requestThe service should start with npm install && node server.js or the Python equivalent.