Add check to upload CSV file's content-type.

src/plone/restapi/services/aliases/add.py

@@ -94,11 +94,19 @@ def _reply_csv(self):
         form = self.request.form
         if not form.get("file"):
             raise BadRequest("No file uploaded")
+
+        file = form["file"]
+
+        if not hasattr(file, "headers"):
+            raise BadRequest("Uploaded file is not a valid file")
+        if file.headers.get("Content-Type") not in ("text/csv", "application/csv"):
+            raise BadRequest("Uploaded file is not a valid CSV file")
+
         controlpanel = RedirectsControlPanel(self.context, self.request)
         storage = getUtility(IRedirectionStorage)
         status = IStatusMessage(self.request)
         portal = getSite()
-        file = form["file"]
+
         controlpanel.upload(file, portal, storage, status)
         file.close()