protected StreamedContent createStreamedContentForCropping(FacesContext context, ImageCropper component) throws IOException {
        InputStream inputStream = null;
        String contentType = null;
        String imagePath = null;
        String originalFileName = null;

        // try to evaluate as Resource object, otherwise we would need to handle the Resource#resourcePath which would be more awkward
        ValueExpression imageVE = component.getValueExpression(ImageCropperBase.PropertyKeys.image.toString());
        Resource resource = ResourceUtils.evaluateResourceExpression(context, imageVE);
        if (resource != null) {
            inputStream = resource.getInputStream();
            contentType = resource.getContentType();
            originalFileName = resource.getResourceName();
        }
        else {
            Object imageObject = component.getImage();
            if (imageObject instanceof String) {
                imagePath = (String) imageObject;
                originalFileName = imagePath;

                boolean isExternal = imagePath.startsWith("http");

                if (isExternal) {
                    URL url;
                    try {
                        url = new URI(imagePath).toURL();
                    }
                    catch (URISyntaxException e) {
                        throw new FacesException(e);
                    }
                    URLConnection urlConnection = url.openConnection();
                    inputStream = urlConnection.getInputStream();
                    contentType = urlConnection.getContentType();
                }
                else {
                    ExternalContext externalContext = context.getExternalContext();
                    String webRoot = externalContext.getRealPath(Constants.EMPTY_STRING);
                    String fileSeparator = Constants.EMPTY_STRING;
                    if (!(webRoot.endsWith("\\") || webRoot.endsWith("/"))
                            && !(imagePath.startsWith("\\") || imagePath.startsWith("/"))) {
                        fileSeparator = "/";
                    }

                    // GitHub #3268 OWASP Path Traversal
                    String path = webRoot + fileSeparator + imagePath;
                    File file = new File(path);
                    FileUploadUtils.requireValidFilePath(file.getCanonicalPath(), false);
                    inputStream = Files.newInputStream(file.toPath());
                }
            }
            else if (imageObject instanceof StreamedContent) {
                StreamedContent streamedContentTmp = (StreamedContent) imageObject;
                inputStream = streamedContentTmp.getStream().get();
                contentType = streamedContentTmp.getContentType();
                originalFileName = streamedContentTmp.getName();
            }
            else {
                throw new IllegalArgumentException("ImageCropper 'image' must be either a String relative path or a StreamedObject.");
            }
        }

        // wrap input stream by BoundedInputStream to prevent uncontrolled resource consumption (#3286)
        if (component.getSizeLimit() != null) {
            inputStream = new BoundedInputStream(inputStream, component.getSizeLimit());
        }

        originalFileName = FilenameUtils.getName(originalFileName);
        if (LangUtils.isBlank(originalFileName)) {
            // most likely stream.getName was not set by user
            String format = guessImageFormat(contentType, Constants.EMPTY_STRING);
            originalFileName = "unknown." + format;
        }

        InputStream finalInputStream = inputStream;
        return DefaultStreamedContent.builder()
                .name(originalFileName)
                .stream(() -> finalInputStream)
                .contentType(contentType)
                .build();
    }
Attempt to obtain the image format used to write the image from the contentType or the image's file extension.
primefaces/src/main/java/org/primefaces/component/imagecropper/ImageCropperRenderer.java