Restricting HTML file input to accept only .txt, and not .csv (in Chrome)

Issue

I tried to filter file format to accept only .txt in HTML. Here's my HTML code:

<Input
 type="file"
 accept="text/plain"
/>

In Safari, it works and only .txt files show up, but in Chrome (63.0.3239.84) the file selector also shows .csv files.

Is it possible to exclude .csv files in Chrome?

Solution

The accept attribute specifies the types of files that the form input will accept.

Syntax

<input accept="file_extension|audio/*|video/*|image/*|media_type">

Tip: To specify more than one value, separate the values with a comma (e.g. .

---

Solution

Simply include the filetype you'd like to allow in the accept attribute, as follows:

<input accept=".txt"

Note: Because this file-restriction is client-side, users are able to remove this attribute and bypass this file-restriction, potentially leading to a vulnerability.

Answered By - Trent