Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF?
Also don't get focused on the GitHub example. In am wondering in general if changing a files extension (not totally-not-virus.mp4.exe, but virus.pdf or virus.txt) can cause trouble.
Anything can happen and what exactly happens depends on the server side code of the web application. Some believe in extensions, some believe in the content, some can be tricked with polyglot attacks, ... Thus in the best case nothing happens or you get an error because content is not allowed and in the worst case you can execute code on the server.
If done right any user generated data should be considered a possible attack by the server and thus handled with lots of care. But in practice servers can often be exploited because they trust user generated data too much. This includes but is not limited to trusting the file extension. Current example:trusting an image upload (imagetragick).
It depends. If the server and people who recive the code try to use it as a PNG, the PNG viewer could not work or give an error. Also there is a website which turns JS into a valid, displayable PNG. But the code wont run unless you try to execute it. You could also rename a file hello3pm.exe to hello(special unicode symbol)3pm.exe and it'll display as helloexe.mp3 on windows and will run on click. I dont remember the special reversing unicode symbol and most Anti-Viruses will react scarly to files with the special thing in the name.
