Attachments on Emails don't fire the Before Insert Trigger on Attachments

Question

We are currently undergoing a security audit of our Organization. We were cited for a finding for not preventing executables from being uploaded to our Organization.

To resolve this, we created a Before Insert on the Attachment object to confirm that the file extension and file type were both on our white list of permissible file types. If the file extension or file type is not permissible, the Body of the attachment is replaced with a text blob with a message stating the file was removed and the file extension and file type are updated to 'text/plain'.

This work wonderfully for Attachments added via the Add Attachment button on the Attachments related list. However, our auditor found a work around. If you create an Email and add the file as an attachment to the Email, then it will still go through.

The odd part is that while that file is stored in the Organization (the object ID is prefixed with 00P), inserting that Attachment doesn't fire the Before Insert trigger on the Attachment object.

My question: What is the mechanism by which Salesforce inserts Email Attachments into the Database such that they are stored as Attachments but does not fire the Before Insert trigger.

Answer 1

According to the docs

Triggers on the Attachment object don’t fire when:

the attachment is created via Case Feed publisher.

the user sends email via the Email related list and adds an attachment file.

Triggers fire when the Attachment object is created via Email-to-Case or via the UI.

Document Reference

So i think this is causing the problem.You need to run the batch to check attachment and update them if needed.