A file list without thumbnails is a worse product than a file list with them, and the pipeline is
the part that takes time.
Scope:
- generate on demand rather than on upload, and cache the result as a derived blob keyed by the
source digest, so identical files share one thumbnail
- images first; video needs ffmpeg and is a bigger dependency decision
- bound the work: refuse absurd dimensions, cap decode memory, and never let a crafted file become a
decompression bomb that takes the server down
The security bound is the interesting part. Image decoders are a classic remote-code-execution
surface, so this deserves an explicit decision about whether decoding runs in-process at all.
A file list without thumbnails is a worse product than a file list with them, and the pipeline is
the part that takes time.
Scope:
source digest, so identical files share one thumbnail
decompression bomb that takes the server down
The security bound is the interesting part. Image decoders are a classic remote-code-execution
surface, so this deserves an explicit decision about whether decoding runs in-process at all.