The essay question's file type restriction only validates on mimetype, not actual extension, meaning that many files can be substituted for each other, like a .txt and a .java, both of which are text/plain.

The assign tool, which has a similar restriction, uses the mimetype restriction at the upload step (since I think that is all the filepicker supports currently...) but does a validation when you try and save, and won't let you continue if there files with unallowed extensions.

The question should follow the same scheme (or filepicker should be updated to allow direct limitation of file extension, not just mime).