A lab application accepts an uploaded file and serves it from an executable script directory. Which control combination is most appropriate?

1. Restrict permitted content and store uploads outside executable paths
2. Trust the client-supplied filename extension alone
3. Make the upload directory writable by every local user
4. Suppress upload error messages but keep execution enabled