I am testing an image uploader but I'm a mere developer. Here are the main points to consider:
- There are no extension checks.
- The image is uploaded to memory.
- It is modified to be a certain size (50px x 50px).
- It is saved to the database.
- From testing, it seems if the image size failed, then on re-render the image displayed is simply broken
- The app is asp.net and is on a Windows server.
With the exception of dodgy file name changing in Linux, is there a weakness? Can anything be executed if it's saved to the DB? I will suggest whitelisting extensions and content type, but is it necessary? If possible please provide a very basic (safe!) example of any major issues.