We are currently developing a web app that allows users to upload files to act as attachments to information they provide.
Obviously allowing users to upload any file types is very dangerous, therefore we're adding steps to stop certain files.
Primarily exe and zip. But the thought has occurred that a user could simply rename a .exe and give it another extension. So now we're thinking about checking the header file to ensure it's actually the file type it says it is, but is this actually necessary? Would there be a way for a user to change the extension and still have the file as malicious or auto running? Surely the change of extension would mean it was handled incorrectly by windows?