Initializing help system before first use

Blocked Attachment Types

App and Scenario attachment filename extensions are validated against a blacklist of extensions that are considered potentially harmful.

FICO® Xpress Insight Server blocks the ability to upload or download attachments with blacklisted filename extensions. If a blacklisted attachment is accessed or created during model execution, it will cause the execution to complete with errors, and write an error message into the run log. The server will block any import or upload of a Repository, App, Folder, or Scenario that contains one or more attachments with blacklisted filename extensions, and will display an error message to the user.

The default list of blocked filename extensions is: apk, asp, aspx, bat, bin, c, cc, class, conf, cpp, css, dll, exe, gif, iso, java, js, jse, jsp, lib, php, phps, phtml, properties, ps1, rar, rpm, sh, swf, tar, tga, tiff, vb, vbe, vbs, vbscript, war, xlm, xlsm, xltm, xsdt

The functionality also operates if multiple extensions are appended to a file, so for example, "test.exe.txt" will be blocked.

Configure the attachment extensions blacklist

If Xpress Insight Server is installed on-premise, the blacklist of filename extensions can be customized in the server standalone.xml configuration by setting the property com.fico.xpress.insight.FileExtensionBlackList to a comma-separated list of extensions.
  1. Open the standalone.xml file (located at <xpressdir>\insight\server\wildfly-x.y.z.Final\standalone\configuration\, when using the default installation settings).
  2. The FileExtensionBlacklist is in the <system-properties> block. 
    <property name="com.fico.xpress.insight.FileExtensionBlackList" value="apk, asp, aspx, bat, bin, c, cc, class, conf, cpp, css, dll, exe, gif, iso, java, js, jse, jsp, lib, php, phps, phtml, properties, ps1, rar, rpm, sh, swf, tar, tga, tiff, vb, vbe, vbs, vbscript, war, xlm, xlsm, xltm, xsdt"/>
    To prohibit a file extension type, add the extension, without a dot prefix, as a new entry in the comma separated list. To permit a file extension type, remove it from the list.
Note This capability is not available when using the DMP version of Xpress Insight.
Parent Topic Securing FICO Xpress Insight

© 2001-2020 Fair Isaac Corporation. All rights reserved. This documentation is the property of Fair Isaac Corporation (“FICO”). Receipt or possession of this documentation does not convey rights to disclose, reproduce, make derivative works, use, or allow others to use it except solely for internal evaluation purposes to determine whether to purchase a license to the software described in this documentation, or as otherwise set forth in a written software license agreement between you and FICO (or a FICO affiliate). Use of this documentation and the software described in it must conform strictly to the foregoing permitted uses, and no other use is permitted.