Allowed file types validation in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of allowed file types validation in Flask?

It ensures that only files with specific extensions (like .jpg, .png) are accepted for upload, improving security and preventing unwanted file types.

beginner

How do you define allowed file extensions in a Flask app?

You create a set of allowed extensions, for example: ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif'}, and check uploaded files against this set.

beginner

What Flask method helps to check if a file has an allowed extension?

A common method is to write a function like allowed_file(filename) that returns True if the file extension is in the allowed set.

intermediate

Why should you check the file extension instead of just trusting the file's MIME type?

File extensions are easier to check and prevent many unwanted files. MIME types can be spoofed or missing, so extension checking adds a simple, effective layer of security.

beginner

What happens if a user uploads a file with a disallowed extension in Flask?

The app should reject the file upload, often by returning an error message or redirecting the user, preventing the file from being saved or processed.

Which Python data structure is best for storing allowed file extensions in Flask?

A Set

B List

C Dictionary

D Tuple

A set allows fast membership checks and avoids duplicates, making it ideal for allowed file extensions.

What does the function allowed_file(filename) typically check?

A If the file name contains spaces

B If the file size is below a limit

C If the file MIME type is image/jpeg

D If the file extension is in the allowed set

The function checks if the file extension matches one of the allowed types.

Why is it important to validate file types on the server side in Flask?

A To reduce server memory usage

B To prevent malicious files from being uploaded

C To speed up file uploads

D To improve client-side rendering

Server-side validation protects the app from harmful files regardless of client behavior.

Which of these extensions would be allowed if ALLOWED_EXTENSIONS = {'png', 'jpg'}?

A photo.png

B script.py

C document.pdf

D image.jpeg

Only files with .png or .jpg extensions are allowed; photo.png matches.

What should your Flask app do if a file with a disallowed extension is uploaded?

A Accept and save the file

B Ignore the file silently

C Reject the upload and notify the user

D Rename the file to an allowed extension

Rejecting and notifying the user prevents unwanted files and informs them of the issue.

Explain how to implement allowed file types validation in a Flask app.

Think about checking the file name's ending and comparing it to a list.

Why is allowed file types validation important for web applications handling uploads?

Consider what could happen if any file type was accepted.

Practice

1. What is the main purpose of validating allowed file types in a Flask upload feature?

easy

A. To compress files before saving

B. To speed up the file upload process

C. To automatically rename files on upload

D. To ensure only safe and expected file formats are accepted

Solution

1. Step 1: Understand file upload risks

   Uploading files without validation can allow harmful files that may damage the server or application.

2. Step 2: Purpose of allowed file types

   Checking allowed file types restricts uploads to safe, expected formats, reducing security risks.

3. Final Answer:

   To ensure only safe and expected file formats are accepted -> Option D

4. Quick Check:

   Allowed file types = safety [OK]

Hint: Allowed types protect from unsafe uploads [OK]

Common Mistakes:

• Thinking validation speeds upload
• Confusing validation with renaming
• Assuming validation compresses files

2. Which of the following is the correct way to check if a filename has an allowed extension in Flask?

easy

A. if filename.split('.')[-1] in allowed_extensions:

B. if filename.endswith(allowed_extensions):

C. if filename in allowed_extensions:

D. if allowed_extensions.contains(filename):

Solution

1. Step 1: Extract file extension correctly

   Splitting the filename by '.' and taking the last part gets the extension.

2. Step 2: Check extension in allowed set

   Using 'in' checks if the extension is in the allowed_extensions set.

3. Final Answer:

   if filename.split('.')[-1] in allowed_extensions: -> Option A

4. Quick Check:

   Split and check extension [OK]

Hint: Split filename by '.' and check last part [OK]

Common Mistakes:

• Using endswith with a set (wrong syntax)
• Checking whole filename in allowed extensions
• Using non-existent 'contains' method

3. Given this Flask snippet, what will be the output if the uploaded file is named photo.png and allowed_extensions = {'png', 'jpg'}?

filename = 'photo.png'
if filename.split('.')[-1] in allowed_extensions:
    result = 'Allowed'
else:
    result = 'Not Allowed'

medium

A. Allowed

B. Not Allowed

C. Error: split method missing

D. Error: allowed_extensions undefined

Solution

1. Step 1: Extract extension from filename

   Splitting 'photo.png' by '.' gives ['photo', 'png'], last part is 'png'.

2. Step 2: Check if extension is allowed

   'png' is in the set {'png', 'jpg'}, so condition is True and result is 'Allowed'.

3. Final Answer:

   Allowed -> Option A

4. Quick Check:

   Extension 'png' in allowed set [OK]

Hint: Check last part after '.' in allowed set [OK]

Common Mistakes:

• Confusing filename with extension
• Assuming split returns error
• Forgetting to define allowed_extensions

4. Identify the error in this Flask file validation code:

allowed_extensions = {'txt', 'pdf'}
filename = 'report.pdf'
if filename.split('.')[-1] == allowed_extensions:
    print('File allowed')
else:
    print('File not allowed')

medium

A. allowed_extensions should be a list, not a set

B. filename.split('.')[-1] is incorrect syntax

C. Using '==' instead of 'in' to check extension

D. Missing import for split function

Solution

1. Step 1: Understand the comparison

   The code compares a string (extension) to a set using '==', which is always False.

2. Step 2: Correct way to check membership

   Use 'in' operator to check if extension is inside allowed_extensions set.

3. Final Answer:

   Using '==' instead of 'in' to check extension -> Option C

4. Quick Check:

   Use 'in' for membership check [OK]

Hint: Use 'in' to check if extension is allowed [OK]

Common Mistakes:

• Using '==' instead of 'in'
• Thinking split needs import
• Confusing set with list requirement

5. You want to allow only image files with extensions 'png', 'jpg', and 'jpeg' in your Flask app. Which code snippet correctly validates the uploaded file's extension and handles the case where the filename has no extension?

hard

A. allowed = {'png', 'jpg', 'jpeg'}
if filename.endswith(tuple(allowed)):
save_file()
else:
reject_file()

B. allowed = {'png', 'jpg', 'jpeg'}
if '.' in filename and filename.rsplit('.', 1)[1].lower() in allowed:
save_file()
else:
reject_file()

C. allowed = ['png', 'jpg', 'jpeg']
if filename.split('.')[-1] in allowed:
save_file()
else:
reject_file()

D. allowed = {'png', 'jpg', 'jpeg'}
if filename.split('.')[1] in allowed:
save_file()
else:
reject_file()

Solution

1. Step 1: Check for presence of extension

   Using '.' in filename ensures the file has an extension to avoid errors.

2. Step 2: Extract extension safely and check membership

   Using rsplit('.', 1)[1].lower() gets the extension after the last dot, then checks if it's in allowed set.

3. Step 3: Handle saving or rejecting file

   If extension is allowed, call save_file(), else reject_file().

4. Final Answer:

   allowed = {'png', 'jpg', 'jpeg'} if '.' in filename and filename.rsplit('.', 1)[1].lower() in allowed: save_file() else: reject_file() -> Option B

5. Quick Check:

   Check dot, split once from right, then 'in' allowed [OK]

Hint: Check '.' then rsplit once, then 'in' allowed [OK]

Common Mistakes:

• Not checking if filename has '.' before splitting
• Using split without limit causing errors
• Using endswith with tuple but missing case normalization