Allowed file types validation in Flask - Step-by-Step Execution

Concept Flow - Allowed file types validation

User uploads file

↓

Check file extension

↓

Accept file

↓

Save file

↓

End

The flow checks the uploaded file's extension. If allowed, it saves the file; otherwise, it rejects it with an error.

Execution Sample

Flask

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif'}

def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

file = 'example.JPG'
result = allowed_file(file)

This code checks if the file 'example.JPG' has an allowed extension ignoring case.

Execution Table

Step	Action	Evaluation	Result
1	Check if '.' in 'example.JPG'	True	Continue
2	Split 'example.JPG' by last '.'	['example', 'JPG']	Extension = 'JPG'
3	Convert extension to lowercase	'jpg'	Extension = 'jpg'
4	Check if 'jpg' in ALLOWED_EXTENSIONS	True	File allowed
5	Return True from allowed_file		True

💡 File extension 'jpg' is allowed, so function returns True

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
filename	'example.JPG'	'example.JPG'	'example.JPG'	'example.JPG'
extension	N/A	'JPG'	'jpg'	'jpg'
allowed_file result	N/A	N/A	N/A	True

Key Moments - 2 Insights

Why do we convert the file extension to lowercase before checking?

Because file extensions can be uppercase or mixed case, converting to lowercase ensures the check against ALLOWED_EXTENSIONS is case-insensitive, as shown in step 3 of the execution_table.

What happens if the filename does not contain a '.' character?

The function returns False immediately because the condition '.' in filename fails (step 1), so the file is rejected.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'extension' after step 3?

A 'jpg'

B 'example'

C 'JPG'

D None

💡 Hint

Check the 'Evaluation' column at step 3 in the execution_table.

At which step does the function decide the file is allowed?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look for the step where the extension is checked against ALLOWED_EXTENSIONS.

If the filename was 'filetxt' without a dot, what would the function return?

A True

B False

C Error

D None

💡 Hint

Refer to step 1 in the execution_table where the presence of '.' is checked.

Concept Snapshot

Allowed file types validation in Flask:
- Define ALLOWED_EXTENSIONS set with allowed suffixes
- Check if filename contains '.'
- Extract extension after last '.' and convert to lowercase
- Return True if extension in allowed set, else False
- Use this function to accept or reject uploaded files

Full Transcript

This visual trace shows how Flask validates allowed file types by checking the file extension. First, it confirms the filename contains a dot. Then it extracts the extension after the last dot and converts it to lowercase to ensure case-insensitive matching. Next, it checks if this extension is in the allowed set. If yes, the file is accepted; otherwise, it is rejected. This prevents users from uploading disallowed file types. The example uses 'example.JPG' which passes validation because 'jpg' is allowed.

Practice

1. What is the main purpose of validating allowed file types in a Flask upload feature?

easy

A. To compress files before saving

B. To speed up the file upload process

C. To automatically rename files on upload

D. To ensure only safe and expected file formats are accepted

Solution

1. Step 1: Understand file upload risks

   Uploading files without validation can allow harmful files that may damage the server or application.

2. Step 2: Purpose of allowed file types

   Checking allowed file types restricts uploads to safe, expected formats, reducing security risks.

3. Final Answer:

   To ensure only safe and expected file formats are accepted -> Option D

4. Quick Check:

   Allowed file types = safety [OK]

Hint: Allowed types protect from unsafe uploads [OK]

Common Mistakes:

• Thinking validation speeds upload
• Confusing validation with renaming
• Assuming validation compresses files

2. Which of the following is the correct way to check if a filename has an allowed extension in Flask?

easy

A. if filename.split('.')[-1] in allowed_extensions:

B. if filename.endswith(allowed_extensions):

C. if filename in allowed_extensions:

D. if allowed_extensions.contains(filename):

Solution

1. Step 1: Extract file extension correctly

   Splitting the filename by '.' and taking the last part gets the extension.

2. Step 2: Check extension in allowed set

   Using 'in' checks if the extension is in the allowed_extensions set.

3. Final Answer:

   if filename.split('.')[-1] in allowed_extensions: -> Option A

4. Quick Check:

   Split and check extension [OK]

Hint: Split filename by '.' and check last part [OK]

Common Mistakes:

• Using endswith with a set (wrong syntax)
• Checking whole filename in allowed extensions
• Using non-existent 'contains' method

3. Given this Flask snippet, what will be the output if the uploaded file is named photo.png and allowed_extensions = {'png', 'jpg'}?

filename = 'photo.png'
if filename.split('.')[-1] in allowed_extensions:
    result = 'Allowed'
else:
    result = 'Not Allowed'

medium

A. Allowed

B. Not Allowed

C. Error: split method missing

D. Error: allowed_extensions undefined

Solution

1. Step 1: Extract extension from filename

   Splitting 'photo.png' by '.' gives ['photo', 'png'], last part is 'png'.

2. Step 2: Check if extension is allowed

   'png' is in the set {'png', 'jpg'}, so condition is True and result is 'Allowed'.

3. Final Answer:

   Allowed -> Option A

4. Quick Check:

   Extension 'png' in allowed set [OK]

Hint: Check last part after '.' in allowed set [OK]

Common Mistakes:

• Confusing filename with extension
• Assuming split returns error
• Forgetting to define allowed_extensions

4. Identify the error in this Flask file validation code:

allowed_extensions = {'txt', 'pdf'}
filename = 'report.pdf'
if filename.split('.')[-1] == allowed_extensions:
    print('File allowed')
else:
    print('File not allowed')

medium

A. allowed_extensions should be a list, not a set

B. filename.split('.')[-1] is incorrect syntax

C. Using '==' instead of 'in' to check extension

D. Missing import for split function

Solution

1. Step 1: Understand the comparison

   The code compares a string (extension) to a set using '==', which is always False.

2. Step 2: Correct way to check membership

   Use 'in' operator to check if extension is inside allowed_extensions set.

3. Final Answer:

   Using '==' instead of 'in' to check extension -> Option C

4. Quick Check:

   Use 'in' for membership check [OK]

Hint: Use 'in' to check if extension is allowed [OK]

Common Mistakes:

• Using '==' instead of 'in'
• Thinking split needs import
• Confusing set with list requirement

5. You want to allow only image files with extensions 'png', 'jpg', and 'jpeg' in your Flask app. Which code snippet correctly validates the uploaded file's extension and handles the case where the filename has no extension?

hard

A. allowed = {'png', 'jpg', 'jpeg'}
if filename.endswith(tuple(allowed)):
save_file()
else:
reject_file()

B. allowed = {'png', 'jpg', 'jpeg'}
if '.' in filename and filename.rsplit('.', 1)[1].lower() in allowed:
save_file()
else:
reject_file()

C. allowed = ['png', 'jpg', 'jpeg']
if filename.split('.')[-1] in allowed:
save_file()
else:
reject_file()

D. allowed = {'png', 'jpg', 'jpeg'}
if filename.split('.')[1] in allowed:
save_file()
else:
reject_file()

Solution

1. Step 1: Check for presence of extension

   Using '.' in filename ensures the file has an extension to avoid errors.

2. Step 2: Extract extension safely and check membership

   Using rsplit('.', 1)[1].lower() gets the extension after the last dot, then checks if it's in allowed set.

3. Step 3: Handle saving or rejecting file

   If extension is allowed, call save_file(), else reject_file().

4. Final Answer:

   allowed = {'png', 'jpg', 'jpeg'} if '.' in filename and filename.rsplit('.', 1)[1].lower() in allowed: save_file() else: reject_file() -> Option B

5. Quick Check:

   Check dot, split once from right, then 'in' allowed [OK]

Hint: Check '.' then rsplit once, then 'in' allowed [OK]

Common Mistakes:

• Not checking if filename has '.' before splitting
• Using split without limit causing errors
• Using endswith with tuple but missing case normalization