Unanswered

Preventing File Extension Forgery in Dataverse File Uploads

(1) Share

Report

Posted on by ashley4234

Hello,
I'm currently developing an app that only allows PDF file uploads to Dataverse. However, I'm concerned about potential file extension forgery attempts, where users might change the extension of a non-PDF file to ".pdf" and upload it.

I've reviewed Microsoft's documentation (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/files-images-overview), which indicates that file restrictions can be implemented based on file extension and MIME type. However, I'm unclear about how Dataverse determines a file's MIME type. Therefore, I'd like to ask the following:

Can Dataverse identify non-PDF files from their content even if they have the ".pdf" extension?
If Dataverse cannot determine file format based on content, are there any alternative methods (within or outside Dataverse) to prevent file extension forgery?

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (2)

Answers (0)

Sort by

MichaelFP 2,008 Moderator on at

Like
a
(2)

Report
Copy link

Link copied!

Hi!

On the Private + Security Menu on the settings of the environment you can set the mime types allowed. So the Dataverse will gonna open the file and check the mime type to see if it is allowed to be inserted.

This options affects all uploads attachments, file field, timeline and e-mail.

If my answer helped you, please give me a thumbs up (👍). If solve your question please mark as solution ✔️. This is help the community.

Was this reply helpful? Yes No
ashley4234 5 on at

Like
a
(0)

Report
Copy link

Link copied!

Thank you for your response!
I apologize for asking again, but is it correct to understand that MIME types are determined based on file's content in Dataverse?
I came across an article that stated that MIME types are determined solely from the extension attached to the uploaded file in Dataverse, so I'm a bit concerned.

Was this reply helpful? Yes No