PreviousNext
AI-assisted engineering/Reviewing AI code

Fix the file name check in a thumbnail helper

Review the AI's codeEasy10 min

Your task

An AI wrote a thumbnail helper that ran os.system(f"convert uploads/{filename} ...") with the uploaded file's name. A name like x.jpg; rm -rf ~ # would run a second command. The fix hands subprocess.run a list of arguments with no shell, and accepts only safe file names.

An assistant wrote build_convert_argv(filename). It is in the editor. It has a bug. Find it and fix it.

Input and output:

  • filename: the uploaded file's name.
  • Return ["convert", "uploads/<filename>", "-resize", "200x200", "thumbs/<filename>"] when the name is safe, or [] to refuse the upload.

Rules the tests check. A name is safe only when all of these hold:

  • It is 1 to 100 characters long.
  • Every character is an ASCII letter, a digit from 0 to 9, ., _ or -.
  • It does not start with ., so it cannot be .. (the parent folder) or a hidden file.

Examples

build_convert_argv(filename: str) -> list[str]
Example 1
Inputbuild_convert_argv("photo.jpg")
Output["convert", "uploads/photo.jpg", "-resize", "200x200", "thumbs/photo.jpg"]
Example 2
Inputbuild_convert_argv("x.jpg; rm -rf ~ #")
Output[]
Example 3
Inputbuild_convert_argv("my-photo_2.PNG")
Output["convert", "uploads/my-photo_2.PNG", "-resize", "200x200", "thumbs/my-photo_2.PNG"]