Problem/Motivation
file_validate_extensions was deprecated in favor of constraint validators in #3221793: Move file upload validation from file.module to constraint validators
Until Drupal 11, file_validate_extensions should continue to work as it always did. However, FileUploadHandler::handleExtensionValidation does not have a BC layer, and if $validators['FileExtension'] is not found, then DEFAULT_EXTENSIONS is used instead of the extensions configured by file_validate_extensions
protected function handleExtensionValidation(array &$validators): string {
// Build a list of allowed extensions.
if (isset($validators['FileExtension'])) {
if (!isset($validators['FileExtension']['extensions'])) {
// If 'FileExtension' is set and the list is empty then the caller wants
// to allow any extension. In this case we have to remove the validator
// or else it will reject all extensions.
unset($validators['FileExtension']);
}
}
else {
// No validator was provided, so add one using the default list.
// Build a default non-munged safe list for
// \Drupal\system\EventSubscriber\SecurityFileUploadEventSubscriber::sanitizeName().
$validators['FileExtension'] = ['extensions' => self::DEFAULT_EXTENSIONS];
}
return $validators['FileExtension']['extensions'] ?? '';
}
A fix for this should go in the 10x branch, but isn't needed in 11 since file_validate_extensions support is removed.