Notes File upload control should have a file type checking that only permits the upload of appropriate files and does not permit uploading any server-side scripts or executable files (e.g. .php, .jsp, etc.) or client-side executable files (e.g. .exe).

I would like to get the file type based on the content of the file and not just based on the extension. Apache Tika could be used to get the metadata of the file and return the file type

similiar idea for Java env https://domino-ideas.hcltechsw.com/ideas/DDXP-I-1231

Any update on this enhancement? It is a huge security ristk.

We have Vulnerabilities for this type of issues, is it possible to use any tools to check in form MIME type also without using xpages

Lotusscript should be able to know the mime of the file to be processed so that in the webquerysave it can be controlled, since it can lead to security errors among the users of the applications