FileExtensionValidator's allowed_extensions must be given in lower case

[Arne de Laat]

Using any uppercase character for an 'allowed_extension' prevents it from being matched. Because the input filename is being lowered before comparison to the extensions.

Here is an example:

from django.core.validators import FileExtensionValidator
from collections import namedtuple

valid = FileExtensionValidator(['pdf', 'png'])
File = namedtuple('File', ['name'])

# valid: different case in file name
named_file = File(name='myfile.PDF')
valid(named_file)
named_file = File(name='myfile.PdF')
valid(named_file)

# using uppercase in validator
valid = FileExtensionValidator(['PDF', 'PNG'])

# invalid: everything, because the case of the input is lowered
named_file = File(name='myfile.PDF')
valid(named_file)
# ValidationError: ["File extension 'pdf' is not allowed. Allowed extensions are: 'PDF, PNG'."]

named_file = File(name='myfile.pdf')
valid(named_file)
# ValidationError: ["File extension 'pdf' is not allowed. Allowed extensions are: 'PDF, PNG'."]

[Tim Graham]

A solution not requiring any code changes would be to document that allowed_extensions should be lower case. Is there a problem with that approach?

[Arne de Laat]

The problem with that is that it would be less obvious, why not simply support case insensitive matching?
Additionally if you retrieve the extensions from some source, as is done to validate images (using the extensions supported by Pillow) you need to ensure those are already lowered, or add some additional code to ensure they are.
Also, the current validation error is also a bit unclear 'pdf' is not allowed. Allowed extensions are: 'PDF', even if the original file extension is PDF. So to clarify that error some code would need to be changed anyway.

[Claude Paroz]

I think that file extensions are case insensitive on all platforms I know. That is I'm not aware of systems/libs/apps which treat file extensions differently whether they are uppercase or lowercase. So I tend to agree with Arne.
If there are use cases for allowing only one or another form, please speak...

[Tim Graham <timograham@…>]

In 681d2599:

Fixed #28165 -- Ignored case in FileExtensionValidator's allowed_extensions.