Permitted File Attachments

When uploading files to FMI Works, certain file types are restricted

The FMI products allow documents to be uploaded and stored with different entities.  This is critical for the proper documentation of certain assets, work orders, etc.

Unfortunately, file attachments may also represent a security risk when used in a web browser.  Some files may be uploaded by other users at other companies with malicious intent.

File Sizes

FMI recommends limiting attachments to 10MB per file as larger file sizes can be used to overload networks and provide denial-of-service type attacks.  

The FMI Works application has a hard-limit of 40MB per file uploaded.

Whitelisted file types

As a best practice, not all file types are allowed to be uploaded and downloaded within applications.  Rather than block the files that are known to be bad, FMI takes the approach of blocking all files unless they are known to be good, or at least are necessary to conduct typical FM business.  This includes general file types for products like Word and Excel as well as industry specific applications like Autodesk Navisworks.

The following file types are whitelisted by FMI:

Customers that have specific needs beyond this list can raise a support ticket for inclusion.  New file types are occurring regularly and we aim to keep this up to date with the needs of customers.

File Validation Rules

In addition to the file extension rules listed above, the system also validates that the type of the file matches the file extension.  This is done to prevent malicious users from hiding potentially dangerous files behind innocent sounding filenames.

The validation is done through a combination of checks ensuring that the file extension, the Mime Type (the type declared by the browser), and the content of the file (through well known signatures) are all consistent.  

For some file types, notably HTML files, the file may present both a security risk and a valid business use.  These files are scanned and are conditionally allowed based on their content.  In the HTML example, they are rejected if there are any "script" tags inside the file.