I am writing a Java web application and I am trying to prevent file upload vulnerabilities by storing uploaded profile pictures as blob in the database. Is it safe to store uploaded images a blob in a database in order to prevent:
- Executing the files with possible LFI vulnerabilities?
- Accessing other users files with path traversal?
Can a file be executed when trying to serve the image when retrieving the file from the database? Can I introduce new vulnerabilities by blobbing?
I am planning to represent the image on the following way:
<img src="/path/to/servlet?userID=1"/>
I use MySQL as a database management system, and Glassfish as a webserver on a Windows Server 2012 R2.