On demand image resizing with node.js in

image_resize.js

// Usage: http://localhost:8080/image.jpg/100x50
var http = require('http');
var spawn = require('child_process').spawn;

http.createServer(function(req, res) {
  var params = req.url.split('/');
  var convert = spawn('convert',  [params[1], '-resize', params[2], '-']);

  res.writeHead(200, {'Content-Type': 'image/jpeg'});
  convert.stdout.pipe(res);
}).listen(8080);


// If you like this, consider attending our Node.js Workshop on June 10th in Cologne:
// http://nodecologne.eventbrite.com/

This seems kind of unsafe passing raw parameters directly into a shell command. Am I missing something? Can extra parameters be passed in to call something else?

As far as I know about how child_process works, this could only ever pass arguments to the "convert" command. Stuff like " && rm -rf /" shouldn't work.

@tylerbenson Sure you would certainly want to have some validation in there if you want to use this in production : ). But @Qard is right, I'd be impressed if you can exploit this.