It's not bad (actually recommended) to not trust the input, thus I verify my preconditions. In this case the precondition is that the file must have the correct extension (so that the correct PIL image gets created) - otherwise cropduster will crash (see https://projects.pbs.org/jira/browse/LUN-1186). I would do that even if the extension and file name are validated in filer.