title: Whitelist or blacklist file extensions for uploads?
body: <p>I'm making a newsletter editor which will allow file uploads (the sender of the newsletter can upload files to the server which will be linked to in the email).  </p>
  
  <p>The site is set up so that only .do URIs are actually executed/handled by servlets so it's not much of a security risk, but I've been told to blacklist .jsp, .php, .asp, .aspx, .exe, .com, and .bat.  This does not strike me as a comprehensive blacklist, and I've the impression that blacklists are not a good policy.</p>
  
  <p>On the other hand, a whitelist would be dozens long.  What's the correct way to identify allowable/disallowable extensions?  Or is it more proper to just allow anything and run it by a virus scanner, or some combination of these?</p>