We are currently undergoing a security audit of our Organization. We were cited for a finding for not preventing executables from being uploaded to our Organization.
To resolve this, we created a Before Insert on the Attachment object to confirm that the file extension and file type were both on our white list of permissible file types. If the file extension or file type is not permissible, the Body of the attachment is replaced with a text blob with a message stating the file was removed and the file extension and file type are updated to 'text/plain'.
This work wonderfully for Attachments added via the Add Attachment button on the Attachments related list. However, our auditor found a work around. If you create an Email and add the file as an attachment to the Email, then it will still go through.
The odd part is that while that file is stored in the Organization (the object ID is prefixed with 00P), inserting that Attachment doesn't fire the Before Insert trigger on the Attachment object.
My question: What is the mechanism by which Salesforce inserts Email Attachments into the Database such that they are stored as Attachments but does not fire the Before Insert trigger.