How to safely resize images and strip GPS metadata from user uploads in Node.js

·2 views

Web developers handling user image uploads face two key risks: privacy exposure through embedded EXIF/GPS metadata and performance issues from large uncompressed files averaging 3–8 MB. The Node.js library Sharp, built on libvips, can resize, recompress, and convert images to WebP while automatically stripping most metadata during re-encoding. Developers must also guard against decompression bombs by capping decoded pixel counts, and avoid blindly stripping all metadata since ICC colour profiles should be preserved for accurate colour rendering. Applications that fetch images via user-supplied URLs are vulnerable to Server-Side Request Forgery (SSRF) attacks unless private and internal IP ranges are explicitly blocked. The article also introduces Purlo, a third-party image processing API that handles these concerns, including SSRF-safe URL fetching, through a simple API call or npm client.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Integrate st-core.fscss CSS Charts into a Svelte App at Build Time

The st-core.fscss library renders charts using pure CSS clip-path polygons and custom properties, requiring no JavaScript chart library, SVG, or canvas. Integrating it into a Svelte or SvelteKit project involves compiling the FSCSS source file into static CSS once at build time using the FSCSS CLI, rather than loading a runtime CDN script on every page load. Svelte's role is limited to reactively mapping data values to CSS custom properties such as --st-p1 and --st-p2, while the browser handles rendering via the compiled CSS. A key constraint is that the array length defined in the FSCSS template must match the number of data points, as it determines the polygon geometry and cannot be changed without recompiling. The article provides component examples for both Svelte 4 and Svelte 5, along with package.json scripts to automate compilation before each build.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most structured data parsers miss JSON-LD inside @graph blocks, audit finds

A developer discovered that nine out of twelve structured data audit tools, including their own, fail to detect schema markup when it is wrapped inside a JSON-LD @graph block rather than a flat top-level object. The @graph format is the default output of popular WordPress SEO plugins Yoast SEO and RankMath, meaning a large share of correctly marked-up web pages are being misread as having no structured data. Unlike flat JSON-LD, the @graph structure allows schema nodes to reference each other by ID, forming a single linked entity graph rather than isolated, redundant blocks. The author identified the bug in their own tool after a well-marked page returned a zero schema score, and traced the root cause to parsers checking only for a top-level @type field. A fix involving recursive node iteration — handling both flat and @graph shapes at the parse boundary — is proposed so that no downstream check needs to account for either format separately.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer stress-tests AI cost-monitoring agent using chaos testing and red teaming

A software developer subjected their AWS cost-monitoring AI agent, built on Amazon Bedrock's AgentCore Runtime using the Strands framework, to deliberate failure and adversarial testing. The agent, which daily reads AWS billing data and emails a color-coded spending report, had never been tested under adverse conditions such as API timeouts, partial data returns, or prompt manipulation. Using Strands Evals 1.0, which shipped chaos testing and red-teaming tools in June, the developer built an isolated lab replica of the agent running on fixture data to avoid incurring real API costs during testing. The key concern was not outright crashes but silent, believable failures — such as a falsely reassuring green-status report while cloud costs quietly escalate. The developer's stated goal is to share replicable testing methods so others can apply the same adversarial evaluation approach to their own AI agents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches Free AI Toolkit for LinkedIn Profiles, Resumes, and Bios

A developer has released ProfileCraftAI, a free, no-signup toolkit designed to help users write LinkedIn headlines, resume summaries, professional bios, and more. The platform offers eight tools in total, built using Next.js for the frontend and Groq's Llama-based API for near-instant text generation, deployed on Vercel. The project was motivated by the developer's observation that many people struggle to articulate their professional identity in writing. Key lessons from the build include the importance of carefully structured prompts to avoid generic AI output, adding educational content alongside each tool to build user trust, and implementing rate limiting early to prevent abuse. The toolkit is publicly accessible at profilecraftai.com, and the developer is actively seeking community feedback on usability and missing features.

0 comments Read more at DEV Community