Mime Types : application/octet-stream

[Guest]

When using CFFILE, I am allowing "text/xml". Client is saving MS Excel as XML. Many test done and has worked until today when the error started occuring that the MIME type is not accepted. I do understand that the "application/octet-stream" MIME type is generated (sometimes) when a file is viewed or save in a word process or spreadsheet application.

The question is ... are there security concerns if I allow "application/octet-stream" MIME type to be uploaded to the server?
Any thoughts or conerns would be appreciated.

-jb

[JR__Bob__Dobbs-qSBHQ2]

The MIME type is provided by the client browser. Is the browser posting an XML file and sending the MIME type as pplication/octet-stream instead of text/xml? In Windows/Internet Explorer MIME types and extensions are associated by a registry entry. If you have access to the client's PC you may wish to check this.

If you allow application/octet-stream you are opening yourself up. I also recommend you check file extensions and only accept uploads from trusted sources.