Add test to verify attachment upload whitelisting