WAF - Allow uploads of only files with certain extensions and block all other file uploads

Hi team,

We need to make some blocks with our WAF on ASM because this block cannot be made on the application side.

We have two web pages on the Internet that allow our customers to fill out a web form and upload some attachments.

Attachment upload is not a mandatory field.

The only file extensions we would like to allow are the following: .jpg,.jpeg,.tiff,.tif,.pdf,.doc,.docx,.xls,.xlsx,.csv

For all other possible extensions we would like the WAF to block the POST call

We initially tried following this article: https://support.f5.com/csp/article/K69153854
This article did not allow us to solve our problem because with the File Types we understood that we can only block requests to certain file types but not prevent their upload

With this article (https://support.f5.com/csp/article/K64356849) we have seen that it is possible to block files containing binary executable content but it would not allow us to block for example the .txt extension

We also tried this article (https://support.f5.com/csp/article/K78925560) but it didn't work. It appears that this feature applies up to version 13.x. Our version is 15.1.5.1

How can we proceed to block the upload of files with disallowed extensions?

Also, would ASM be able to detect the real extension of a file? For example, if I create a file "test.txt" (which needs to be locked) and change the extension to "test.pdf" what would happen? Will the file be locked or not?

Below is a portion of the POST call used to upload files

POST /URI/ HTTP/1.1
Host: xxx.xxx.xxx
User-Agent: 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://xxx.xxx.xxx/URI
Content-Type: multipart/form-data; boundary=---------------------------324342428322538423523377594017
Content-Length: 3763
Origin: https://xxx.xxx.xxx
Connection: keep-alive
Cookie: 
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
X-Forwarded-For: 

-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="Nome"

mario
-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="Email"

mmtest@test.it
-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="Allegati_0"; filename="test.txt"
Content-Type: text/plain

-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="Allegati_0_val"


-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="Allegati_1"; filename=""
Content-Type: application/octet-stream


-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="Allegati_1_val"

-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="btnNext"

Conferma
-----------------------------324342428322538423523377594017
Content-Disposition: form-data; name="HaveDatat1"

1
-----------------------------324342428322538423523377594017--

Thanks