Normally when you want to add an image for a word you have to choose an image from Google, pixabay, etc. However, since custom words can only be seen by whoever made them I think it could be safe to let users upload their own image from their device. I personally use custom words a lot for names and stuff so being able to add my own images would be helpful since finding a picture to help me remember them is pretty hard currently.
Thanks for the suggestion - I'll consider it, but it is more difficult than it may appear due to additional security checks, etc. But I'll add it to my "consider" list!
Uploading an untrusted binary is indeed a very tricky problem, but you may not need to go there. If the image is restricted to a single user, there is no reason to host it all. If you can get away with restricting the image to a single device, just tell the device to display it. If you want to be able to share an image across devices, you could serve them from Google Drive or another cloud storage system that the user is enrolled in.
You could even allow hot linking, although this presents its own set of issues. All in all, a lot of work for little benefit, but fun to think about.
If I were to go that route, it would require a rather large amount of development relative to the impact of the functionality - it would probably be easier (from a time perspective) to just run through the same security procedures I have now for other uploaded images (avatar, etc.).
