What are the consequences of turning off MIME type checking for uploads?

[David Carlin]

Hello,

I am a relatively new administrator to ServiceNow so I am sorry if this is a simple question. A user brought to me an issue they were having when attempting to upload a file to one of their tasks. They were getting the error:

     --filename--.xdmz: File type not permitted or mime type does not match the file content.

After looking around on the community I found that I could resolve this issue by disabling MIME checking. I believe the issue is that there is no MIME type for .xdmz. We have left the "List of file extensions" blank so that we could allow all extensions but we are still getting the error.

Is there a better way to fix this rather than disabling MIME type checking? Is there any risk to disabling MIME type checking?

Thanks!

[Brian Lancaster]

I believe this would open you up to security risks as it would allow any type of file to be attached.

[Brian Lancaster]

Under System properties there is a "List of file extensions (comma-separated) that can be attached to documents via the attachment dialog. Extensions should not include the dot (.) e.g. xls,xlsx,doc,docx. Leave blank to allow all extensions.".  Trying adding that extension here in a subprod instance.  I'm not sure if this is just in addition to what servicenow allows or if you would need to list out all extension type.

[David Carlin · Accepted solution]

Hey Bricast,

I tried adding the .xdmz and .xdoz (without the dot (.)), and it said it was a prohibited file type. It looks like it did not register these extensions. This is still with MIME type checking on.

[Brian Lancaster]

I have been searching thought the community and in ServiceNow docs to see if I could find out how to add a custom MIME type but have not found anything yet.