We have to implement a user profile image upload feature in our web application. The user can upload his profile image.
After uploading the image, it will be saved to a DB2 DB, and it will be rendered only to the user who uploaded the image after the login.
Technology stack is J2EE, AIX, DB2.
We received a strange complaint from our security department that this feature needs to be dropped because the user may upload a virus and this will infect the server!
I don't understand how a user will upload the virus. At the end of the day, the virus is a program that needs to be executed, right?
Second thing: the platform is UNIX-AIX. Even if a user uploaded a malware the server will not be infected, right?
Last thing: there is a possibility that the user would be infected by XSS in the case where a JS file was uploaded instead of image. But, I can see that in our case this is not valid because only the user can upload the image and it will be rendered only to the user.
Is my understanding is right?