In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to limit the files by extension to certain extensions.
I've requested them to provide a solution if the file can't be uploaded, and they allowed us to upload files as zip.
I wonder what's the point in limiting certain extensions to be uploaded if you can upload them anyway as a zip file. Moreover, what's the point in limiting the allowed extensions if at all, having into account that the best measure to avoid a security problem is to have a antivirus in everyone's computer.
Wouldn't it be better to allow any extension and let that job to the antivirus?