Binary attachment upload: Thumbnails for the attachments uploaded in SBL

[Febakke]

Functional architect/designer: @-mention Technical architect: @-mention

Description Should there be thumbnails for the attachments uploaded with the Binary attachment upload?

• Possibility of Thumbnail / miniature image of attachment in SBL (like in Finder on Mac and Finn)
• Should the view of uploaded attachment be the same for all types for attachments and services? Many attachments, different types and so forth.

The Binary attachment component is handled in issue Altinn/altinn-studio#769 (Altinn Studio view) and Altinn/altinn-studio#291 (SBL)

Sketch (if relevant) (Screenshot and link to Figma, make sure your sketch is public!)

Navigation from/to (if relevant) This functionality is reached from...

Technical considerations Input (beyond tasks) on how the user story should be solved can be put here.

Acceptance criterea

• What is allowed/not allowed
• Validations
• Error messages and warnings
• ...

Tasks

• [ ] Example task

[olemartinorg]

Not quite sure what SBL is, but I'm assuming it refers to app-frontend (from context). Meaning, this issue is for showing thumbnails of attachments in app-frontend. While that's entirely possible, it is a lot more difficult than it might appear on the surface.

A few bunch of questions from me:

• Do we download an entire image and scale it on the frontend? Or do we ask the backend to provide us a smaller scale version of the image? Do we store/cache these scaled-down copies, or generate them on the fly each time?
• Which file types do we want to create thumbnails for? Does it make sense to thumbnail/preview images only, or do we want to thumbnail videos, documents and PDFs as well?
• For any file type, if we want/need to generate thumbnails server-side, how do we make sure the thumbnailer service is secure (i.e. if/when a vulnerability is discovered/exploited to execute arbitrary code, how do we ensure it cannot be used to elevate privileges?).

In summary, I don't think this is worth it from a security perspective. With great risks, we'd need to implement this carefully, and such a job would probably cost more than the reward is worth.

[bjosttveit]

In https://github.com/Altinn/app-frontend-react/pull/1199 different icons were added for some different file types. I agree with @olemartinorg that thumbnails are more complicated than they may be worth, so maybe we should consider just adding an icon that indicates an image file type instead?