Initial version

DataTransfer.Client/Services/RiskyFileTypes.cs

@@ -0,0 +1,40 @@
+using System.Collections.Frozen;
+
+namespace DataTransfer.Client.Services;
+
+/// <summary>
+///     File types that can run code when opened, or are commonly used to deliver malware or phishing. Common archives
+///     (zip, 7z, rar) and documents are deliberately not listed, so the warning stays meaningful.
+/// </summary>
+public static class RiskyFileTypes
+{
+    private static readonly FrozenSet<string> Extensions = new[]
+    {
+        // Windows programs and installers
+        "exe", "com", "scr", "pif", "cpl", "msi", "msix", "msixbundle", "msp", "appx", "appxbundle", "appref-ms",
+        "application", "gadget", "dll", "sys", "drv", "ocx",
+
+        // Scripts
+        "bat", "cmd", "ps1", "psm1", "vbs", "vbe", "js", "jse", "mjs", "wsf", "wsh", "wsc", "sct", "hta", "jar", "py",
+        "pyw", "sh", "bash", "command", "applescript", "scpt", "reg", "inf", "msc",
+
+        // Shortcuts and shell files that can launch programs
+        "lnk", "url", "scf", "library-ms", "search-ms", "settingcontent-ms",
+
+        // macOS and Linux applications and packages
+        "app", "pkg", "mpkg", "dmg", "workflow", "action", "deb", "rpm", "appimage", "run", "bin",
+
+        // Disk images, often used to bypass download protection
+        "iso", "img", "vhd", "vhdx",
+
+        // Office documents with macros, add-ins and other formats abused for malware
+        "docm", "dotm", "xlsm", "xltm", "xlam", "xll", "pptm", "potm", "ppam", "ppsm", "sldm", "one", "chm",
+
+        // Web pages opened from disk, a common way to deliver phishing
+        "htm", "html", "xhtml", "mht", "mhtml"
+    }.ToFrozenSet(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>Only the last extension counts, so <c>invoice.pdf.exe</c> is risky and <c>setup.exe.txt</c> is not.</summary>
+    public static bool IsRisky(string? fileName) =>
+        Path.GetExtension(fileName) is { Length: > 1 } extension && Extensions.Contains(extension[1..]);
+}