Comment 2 for bug 1302251

What should we do to fix this? Well, probably the best thing is to just copy the Moodle approach. They only use the file extension to identify files, and they have a pretty large list of known file types. Additionally, we could make this user-extensible, allowing sites to identify other types of obscure or unusual files that their students are uploading.

My only worry is whether this might have any security ramifications. But I think we're pretty safe, because of the limited number of mimetypes that we serve the content back out as. Additionally, we provide the option to pass file uploads through clamav, which should pick up any malicious file uploads.

If trusting the file extension is in general a security issue, then what we could do is just have a list of extension-based exceptions. For instance, if the mimetype detected is zip, then we check the file extension and see that a zip that ends in .docx should be treated as a Word document rather than a zip file.