Additional validation for st.file_uploader files

[sfc-gh-lwilby]

Checklist

• I have searched the existing issues for similar feature requests.
• I added a descriptive title and summary to this issue.

Summary

Only literal comparison is used to enforce file extension restriction.

Users can upload file named "filename.anyExt:$fakeStream.allowedExt" to bypass st.file_uploader type restriction on NTFS.

The request is to add additional validation by putting some kind of validation in the file name for invalid/malicious characters i.e. ', “, :, ; etc.

Note: Streamlit considers this feature a usability feature and expects developers to do additional security validation as required by their application.

Why?

No response

How?

No response

Additional Context

No response

[github-actions]

To help Streamlit prioritize this feature, react with a 👍 (thumbs up emoji) to the initial post.

Your vote helps us identify which enhancements matter most to our users.