For a website I am helping out on, they want to allow users to upload images for display. Obviously this has security implications. I have seen it discussed that uploaded images should be stored outside the webroot and than accessed by a script only.
However, when I reviewed OWASPS’s discussion on file upload security, I did not see any mention by them of the necessity to store uploaded files outside of the webroot. https://www.owasp.org/index.php/Unrestricted_File_Upload . Their list of developer recommendations had a number of other steps to take, but surprisingly to me at least did not seem to mention storing the files outside the webroot.
Can it be considered safe to allow images to be uploaded in the webroot assuming that you follow the recommendations listed by OWASP at the link above?
No it’s not necessary to store the images outside the webroot. You should however make sure that you limit all uploads to jpg’s, png’s, etc. Only image formats, otherwise as explained in the link you posted you do have a risk of attacks on your system. I would also create a folder dedicated to the uploaded images inside the webroot, keeps things more orderly, and make sure all images inside are set to read-only for web users.