We are currently undergoing a security audit of our Organization. We were cited for a finding for not preventing executables from being uploaded to our Organization.

To resolve this, we created a Before Insert on the Attachment object to confirm that the file extension and file type were both on our white list of permissible file types. If the file extension or file type is not permissible, the Body of the attachment is replaced with a text blob with a message stating the file was removed and the file extension and file type are updated to 'text/plain'.

This work wonderfully for Attachments added via the Add Attachment button on the Attachments related list. However, our auditor found a work around. If you create an Email and add the file as an attachment to the Email, then it will still go through.

The odd part is that while that file is stored in the Organization (the object ID is prefixed with 00P), inserting that Attachment doesn't fire the Before Insert trigger on the Attachment object.

My question: What is the mechanism by which Salesforce inserts Email Attachments into the Database such that they are stored as Attachments but does not fire the Before Insert trigger.

  • are you talking about emailToCase? or Email To Salesforce? or inbound Apex email handler?
    – cropredy
    Commented Feb 13, 2016 at 1:06
  • 1
    May be this can be a known issue. check this out success.salesforce.com/issues_view?id=a1p300000008YTEAA2
    – Ratan Paul
    Commented Feb 13, 2016 at 6:22
  • @crop1645 The end goal is to prevent all attachments with a non-white listed extension. We are using a trigger on Attachments Before Insert. This work just fine for attachments introduced via EmailToCase and those introduced by the Attachments related list. The stumbling point in attachments added to OUTBOUND emails via the UI (specifically Email Related List). The Feed File issues were fixed with another trigger, but the Feed Email also has the same issue. I think Ratan and Tushar Sharma have found the answer - but those answers make me sad. We will need a regular batch to do it :(
    – RD3
    Commented Feb 14, 2016 at 14:40

1 Answer 1


According to the docs

Triggers on the Attachment object don’t fire when:

the attachment is created via Case Feed publisher.

the user sends email via the Email related list and adds an attachment file.

Triggers fire when the Attachment object is created via Email-to-Case or via the UI.

Document Reference

So i think this is causing the problem.You need to run the batch to check attachment and update them if needed.

  • 1
    Tushar -- would you be so kind as to edit the answer with a link to the doc?
    – cropredy
    Commented Feb 14, 2016 at 23:18
  • @crop1645 Added the reference. Thanks. Commented Feb 15, 2016 at 3:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .