A city blocks a short list of dangerous extensions but does not normalize case, double extensions, or alternate handlers. What is the sound assessment takeaway?
Select an answer to reveal the explanation.
Short Explanation
A No Trespassing sign that only names three costumes will not stop every costume party. Extension blacklists miss renames, case tricks, and handler quirks. Test carefully under RoE and recommend allowlists — do not turn the finding into a public bypass cookbook.
Full Explanation
Naive extension blacklists are brittle and often bypassable; sound assessment takeaways prefer allowlists and content controls within RoE. A city that blocks only a short list of dangerous extensions without normalizing case, double extensions, or alternate handlers leaves classic bypass terrain—filters look complete while remaining incomplete for real municipal upload abuse.
Blacklists are not complete once three extensions are listed. HTTPS does not make upload filters unnecessary. Filter bypass does not prove DNS misdelegation.
Exam caveat: discuss bypass classes conceptually (case, double extensions, handler mappings) without turning the answer into a payload cookbook. CPTS upload hardening emphasizes allowlists, content checks, and non-exec storage together.
Operational check: inventory allowed types for the civic app, implement allowlist plus content validation, normalize names, disable unexpected handlers, and retest previously blocked/allowed permutations under RoE. Maintain an explicit allowlist of civic upload MIME/extension pairs in configuration-as-code so blacklist drift cannot silently reopen bypasses. Handler mappings (.php.jpg style) belong in the city upload bypass regression suite.