whitelist: check with/without ext