Files Security

MIME Type Restrictions in Web/Desktop Apps

In the web/desktop application, you can send any files except those with a prohibited MIME type. Prohibited files may include some executable files, installation files, and scripts.

Do Restrictions Work Based on File Extensions?

No, restrictions work based on content. For example, most executable files with extensions like exe, deb, etc., have allowed MIME types.

What Happens If the File Content Cannot Be Determined?

If the app cannot determine the MIME type of a file, sending it will be impossible. In such cases, contact eXpress support.

Which MIME Types Are Prohibited by Default?

• application/vnd.microsoft.portable-executable
• application/x-msdos-program
• application/x-ms-dos-executable
• application/x-executable
• application/x-msi
• application/x-debian-package
• application/vnd.debian.binary-package
• application/x-redhat-package-manager
• application/x-apple-diskimage
• application/mac-binhex40
• application/javascript
• application/x-javascript
• application/x-oz-application
• application/x-sh
• application/x-shellscript
• application/x-shockwave-flash
• application/x-java-archive
• application/java-archive
• application/x-xpinstall
• text/iuls

Can the List of Prohibited MIME Types Be Extended?

The organization's administrator may additionally prohibit other MIME types. For consultation, contact your organization's support team or eXpress support.

Blocking of Dangerous Content When Viewing PDFs

Starting with version 3.59, the web and desktop apps do not open PDFs that contain JavaScript for preview. Instead of the document, the app shows the error “File blocked for security reasons”.

Any script in the file triggers blocking: in a link, in a form field, or in the document itself. For example, a link with a javascript: address or a date field that formats its value with a script. Regular links to websites and jumps between document pages do not trigger blocking.

The app also checks the text of comments and form fields: the file is blocked if it contains document., window., innerHTML, or parent..

In a PDF that does open, links, in-document navigation, filling out and submitting forms, and annotations don't work.

How Do I Open a Blocked PDF?

Download the file and open it in a PDF viewer on your computer. Open the file only if you trust the sender: on a computer, a script in the file may run.

How Do I Resave a PDF So That It Opens in eXpress?

The author of the file removes the scripts from the document and saves the PDF again. What to remove depends on the program the PDF was made in:

Program	What it carries over into the PDF
Microsoft Word, Excel, PowerPoint, MyOffice, R7-Office	Links. A link with a script can get into a document, for example, together with a table copied from a web page.
LibreOffice, Apache OpenOffice	Links, form fields with scripts, and comments.
PDF editors: Adobe Acrobat, ABBYY FineReader PDF, Foxit PDF Editor	Everything in the source PDF: scripts, forms, comments.

Remove links, form fields, and comments in the program the document was created in, and save the PDF again. If the blocking is caused by the text of a comment or form field, delete the comment or edit the text.

If there is no source document, Adobe Acrobat Pro, ABBYY FineReader PDF, and Foxit PDF Editor remove scripts and comments from the finished PDF.

Role Model Restrictions for Files

If the role model is enabled and configured on the corporate server, you may encounter warnings such as “This chat has sending restrictions” or other prohibition messages. This means that the chat or channel has restrictions on sending, downloading, or forwarding attachments:

• by file size, for example: “Forwarding videos over 300 MB is restricted,” “This chat has restrictions on sending documents over 20 MB”;
• by file type, for example: “Viewing documents is restricted,” “Downloading images is restricted”;
• by file extension, for example: “Disallowed sending of: docx”, “This chat has restrictions on sending images in this format”;
• by user type or specific users in the chat, for example: “Images are not allowed to be forwarded into chat with the user ...”;
• by action type — sharing, viewing, downloading, or forwarding a file may be prohibited, for example: “You are not allowed to forward videos from this chat”, “This chat has restrictions on viewing attachments”.

What Happens If My Attachment Is Prohibited?

A prohibited attachment can be marked with an error icon or a warning. You can only delete such an attachment. Attachments created within the app, such as photos, can also be downloaded to the device.

Why Is a Renamed File Still Blocked From Sending?

The app determines the file type by its content, not by the extension in its name. Therefore, renaming does not remove the restriction: a document renamed as an image remains a document and is subject to the same restriction.

Is It Possible to Know About Existing Restrictions in Advance?

For more information about the restrictions, click or tap on the Learn more label or the information button in the pop-up warning.

For a detailed description of all role model restrictions for working with files and their application in chats and Smart Apps, see the section “Role Model Rules”.

Contour Restrictions on Sending Files

Your organization's server administrator can allow file sharing and screen sharing only for users within the contour — the internal corporate data transmission system (CDTS). They restrict files in “File Service” > Contour and screen sharing with Enable screen sharing for corporate users outside of contour in the VoEx section. If contour access is enabled, users from an external network may get the “Available only from the company network” error when trying to view a file. Users within the contour will not be able to open files from users outside the contour: they will get the error “You have no access to this file”. To check or configure these restrictions, contact your organization's support team or eXpress support.

Antivirus & DLPS Integrations

The corporate server administrator can enable antivirus scanning of sent files and integration with a DLP system. A file that fails the scan will not be sent. Configuring antivirus scanning and DLP is done in the separate console that manages the integration of the server with the antivirus and DLP system. Detailed information is available in the administrator guide in the Product Documentation section.

Watermark

Starting with server version 3.69 and version 3.70 of the iOS/Android mobile apps, your organization's server administrator can enable a watermark on images and video. They enable it in the File Service section. The mark is applied when they are saved or forwarded from mobile devices. It contains data about the user, time, and device: you can use it to find the source of a file leak.