Address code review: revert to try-with-resources, validate image extensions, clarify JPG-only support

Co-authored-by: cubap <1119165+cubap@users.noreply.github.com>

Author: Copilot

src/java/ImageUpload/FileUpload.java

@@ -24,9 +24,6 @@
 import static java.lang.Integer.parseInt;
 import java.sql.Connection;
 import java.util.*;
-import java.util.logging.Logger;
-import static java.util.logging.Logger.getLogger;
-import static java.util.logging.Level.WARNING;
 import javax.servlet.Servlet;
 import javax.servlet.ServletException;
 import javax.servlet.http.*;
@@ -45,8 +42,6 @@
  * @author obi1one
  */
 public class FileUpload extends HttpServlet implements Servlet {
-   
-   private static final Logger LOG = getLogger(FileUpload.class.getName());
 
    /**
     *
@@ -109,10 +104,8 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws S
          upload.setProgressListener(listener);
 
          session.setAttribute("LISTENER", listener);
-         
-         Connection conn = null;
-         try {
-            conn = getDBConnection();
+
+         try (Connection conn = getDBConnection()) {
             conn.setAutoCommit(false);
             User thisUser = new User(uid);
             String city = req.getParameter("city");
@@ -146,23 +139,8 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws S
                conn.rollback();
             }
          } catch (Exception ex) {
-            if (conn != null) {
-               try {
-                  conn.rollback();
-               } catch (Exception rollbackEx) {
-                  // Log rollback failure but throw original exception
-                  ex.addSuppressed(rollbackEx);
-               }
-            }
             reportInternalError(resp, ex);
          } finally {
-            if (conn != null) {
-               try {
-                  conn.close();
-               } catch (Exception closeEx) {
-                  LOG.log(WARNING, "Failed to close database connection", closeEx);
-               }
-            }
             session.setAttribute("LISTENER", null);
          }
       } else {

src/java/ImageUpload/UserImageCollection.java

@@ -316,8 +316,17 @@ private static String sanitizeFilename(String filename) {
         String extension = "";
         int lastDotIndex = filename.lastIndexOf('.');
         if (lastDotIndex > 0 && lastDotIndex < filename.length() - 1) {
-            name = filename.substring(0, lastDotIndex);
-            extension = filename.substring(lastDotIndex);
+            String potentialExtension = filename.substring(lastDotIndex).toLowerCase();
+            // Validate extension is a known image type (only .jpg supported currently)
+            if (potentialExtension.equals(".jpg") || potentialExtension.equals(".jpeg")) {
+                name = filename.substring(0, lastDotIndex);
+                extension = filename.substring(lastDotIndex);
+            } else {
+                // If not a valid image extension, treat the whole filename as name
+                // This prevents files like "document.pdf" from being treated as images
+                name = filename;
+                extension = "";
+            }
         }
 
         // Handle directory separators (keep them)
@@ -340,7 +349,10 @@ private static String sanitizeFilename(String filename) {
 
     /**
      * Check that the image is actually a valid jpg image by loading it as a
-     * BufferedImage BH TODO strip invalid characters!
+     * BufferedImage and re-saving it as JPG.
+     * 
+     * NOTE: This system only supports JPG format for private uploads as documented
+     * in the upload UI. Images are always scaled to max 2000px height and saved as JPG.
      */
     private static Boolean validateImage(File f) {
         try {
@@ -357,6 +369,7 @@ private static Boolean validateImage(File f) {
                 return false;
             }
 
+            // Scale image to max 2000px height and save as JPG (system only supports JPG)
             img = scale(img, 2000);
             write(img, "jpg", f);
         } catch (Exception e) {