Glad that you are able to see that. The solution you have given is the correct approach. I would still disagree with the "length() - 3" you have when finding the file extension. The point being we shouldn't assume the extension to be always of length 3. (I have had some bitter experiences in other personal projects when I assumed so).

Lastly, I don't think we have to worry about the mime type, instead get the file extension and using that. But at the same time checking the mime type is more secure as you can be sure that no malicious file is downloaded to the user's system.