Allowed file types validation in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output when uploading a .txt file?

Given this Flask code snippet that validates allowed file types, what will be the response if a user uploads a file named notes.txt?

Flask

from flask import Flask, request
app = Flask(__name__)

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif'}

def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files.get('file')
    if file and allowed_file(file.filename):
        return 'File accepted'
    else:
        return 'File type not allowed', 400

A File type not allowed

B File accepted

C 500 Internal Server Error

D No file uploaded

💡 Hint

Check the allowed extensions set and the file extension of the uploaded file.

The allowed file types are only images with extensions png, jpg, jpeg, and gif. A .txt file is not in this set, so the function allowed_file returns False, leading to the 'File type not allowed' response with status 400.

📝 Syntax

intermediate

Which option correctly checks allowed file extensions?

Which of the following functions correctly returns True only if the filename has an allowed extension from the set {'pdf', 'docx', 'txt'}?

A

def allowed_file(filename):
    return filename.split('.')[-1].lower() in {'pdf', 'docx', 'txt'}

B

}'txt' ,'xcod' ,'fdp'{ ni )(rewol.]1-[)'.'(tilps.emanelif nruter    
:)emanelif(elif_dewolla fed

C

def allowed_file(filename):
    return filename.endswith(('.pdf', '.docx', '.txt'))

D

def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in {'pdf', 'docx', 'txt'}

💡 Hint

Consider case sensitivity and filenames without extensions.

Option D correctly checks if there is a dot in the filename and then extracts the extension safely using rsplit. It also converts the extension to lowercase to handle case variations.

Option D does not check if a dot exists and is case sensitive.

Option D uses endswith but this can cause false positives (e.g., 'filepdf').

Option D does not check if a dot exists and incorrectly handles filenames without extensions.

🔧 Debug

advanced

Why does this file validation always fail?

Consider this code snippet. Why does the file validation always reject files even if they have allowed extensions?

Flask

ALLOWED_EXTENSIONS = {'png', 'jpg'}

def allowed_file(filename):
    ext = filename.split('.')[-1]
    return ext in ALLOWED_EXTENSIONS

# Example usage:
print(allowed_file('image.PNG'))  # Returns False

A Because the extension check is case sensitive and 'PNG' != 'png'

B Because the split method is incorrect and does not get the extension

C Because the allowed extensions set is empty

D Because the function does not check if filename contains a dot

💡 Hint

Think about how string comparison works with uppercase and lowercase letters.

The function extracts the extension but does not convert it to lowercase before checking. Since 'PNG' (uppercase) is not equal to 'png' (lowercase), the check fails.

❓ state_output

advanced

What is the value of result after running this code?

Given the following Flask helper function and usage, what is the value of result?

Flask

ALLOWED_EXTENSIONS = {'pdf', 'docx'}

def allowed_file(filename):
    if '.' not in filename:
        return False
    ext = filename.rsplit('.', 1)[1].lower()
    return ext in ALLOWED_EXTENSIONS

result = [allowed_file(f) for f in ['report.PDF', 'summary.docx', 'image.png', 'README']]

A [False, True, False, False]

B [True, True, True, False]

C [True, True, False, False]

D [False, False, False, False]

💡 Hint

Check extension case handling and filenames without extensions.

'report.PDF' converts extension to lowercase 'pdf' which is allowed.

'summary.docx' is allowed.

'image.png' extension 'png' is not in allowed set.

'README' has no dot, so returns False.

🧠 Conceptual

expert

Which approach best prevents security risks in file uploads?

When validating allowed file types in Flask uploads, which approach best reduces security risks?

A Check only the file extension from the filename string

B Check the file extension and also verify the file's MIME type from the request

C Allow all file types and rely on server-side antivirus scanning

D Rename the file to a random name without checking its type

💡 Hint

Think about how attackers can disguise file types.

Checking only the extension (A) is easy to bypass by renaming files.

Verifying MIME type (C) adds a layer of checking the actual content type sent by the browser.

Allowing all files (B) is risky even with antivirus.

Renaming files (D) helps avoid overwriting but does not prevent malicious content.