Open attachment improvements

Best practice to whitelist allowed characters rather than trying to blacklist bad ones