Issue with incorrect file types - Coldfusion and zip files

I am testing the upload suite on a coldfusion site. So far I got everything working but have some issues to report. On the CFFILE upload tag I am specifying what file types to let Coldfusion upload. We have to do this since it is a public upload form and using file extensions is not secure enough.

In testing uploads of zip files using the uploader, it was constantly denied. Some debugging showed that when Aurigma uploaded zip files it was sending a content type of text/html instead of application/zip. To get it to upload and allow zip files I had to accept a file type of text/html which is also not safe.

Not sure if it makes a difference but I am also submitting form data along with the upload. Here is an example of the file type being sent:

Content-Disposition: form-data; name="File0_0"; filename="DogBedWorks.zip" Content-Type: text/html

Compared to a png file which uploads correctly:

Content-Disposition: form-data; name="File0_0"; filename="Category.png" Content-Type: image/png

We have to get this working correctly because allowing html files to be uploaded would be very risky for obvious reasons.

Thanks

Tested with fiddler and have the same issue:

Content-Disposition: form-data; name="File0_0"; filename="LOGOS.zip"
Content-Type: text/html

Not sure what it means but this is with firefox 26 on windows 8.1 pro.

If I test with Explorer I get the correct content type as below:

Content-Disposition: form-data; name="File0_0"; filename="DogTravelWorks.zip"
Content-Type: application/x-zip-compressed

The mime type in the registry is correct. The issue occurs in both html5 uploader and the flash uploader in Firefox.

With Chrome it works fine, uses the html5 uploader and uploads a zip OK

That fixed it! When I looked on the application tab of firefox options, there were several correct entries for zip files and one incorrect one saying they were type text/html. I was not able to delete it in options so I shut down firefox, renamed the mimeTypes.rdf file, and then restarted Firefox. After that zip uploads worked normally using both the flash and the html5 uploaders.

Thanks again. Very strange that Firefox would use it's mime type list to identify outgoing files when the list is supposed to apply to incoming files.