What about extension whitelist checking? This covers the image uploaders, but AttachmentUploader` sets `extension_white_list` so that carrierwave restrict the types of files that can be uploaded. I have a feeling this turns that off but our tests aren't catching it...