I am writing a Java web application and I am trying to prevent file upload vulnerabilities by storing uploaded profile pictures as blob in the database. Is it safe to store uploaded images a blob in a database in order to prevent:

  1. Executing the files with possible LFI vulnerabilities?
  2. Accessing other users files with path traversal?

Can a file be executed when trying to serve the image when retrieving the file from the database? Can I introduce new vulnerabilities by blobbing?

I am planning to represent the image on the following way:

<img src="/path/to/servlet?userID=1"/>

I use MySQL as a database management system, and Glassfish as a webserver on a Windows Server 2012 R2.


I can envisage a couple of possible vulnerabilities that you should keep in mind:

  • Uploaded Data overrun - if there is not a way to limit the size of uploads your server could be damaged by sending it a very large file.
  • Out of bounds access, since you are allowing the image to be served from the database you are allowing read access to the database, if an index is used to access the image it may be possible to access other locations in the DB, likewise if the read allows incremental reading you could receive read requests that take data from outside of the blob.

You should check the server & BD have tests in place to prevent such attacks/misbehaviour.

  • 1
    good answer but not complete you answer only one part of the question. If you want add something about the possibility to execute the file called from the db and i will mark this one as the answer – AXANO Oct 22 '17 at 14:29
  • @AXANO apparently my answer doesn't cover your case :) – elsadek Oct 22 '17 at 18:18

Can a file be executed when trying to serve the image when retrieving the file from the database?

The safest way is not to open the uploaded images in the file system of the server, one way to do -as a bad practice- is to create temporary file to serve the image from.

Instead keep images processing between the Servlet and the client by serving the image binary data right from the database.

byte[] content = resultSet.getBytes("content");

That is, as long as you keep the image file off the file system any potential threat that come within will not be triggered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.