Better not to rely on testing only the extension: that can be forged quite easily.
CSV is comma separated values, right? Try opening the file, then testing against a regex. If it fit's the pattern, you golden, otherwise spit it out.
This (PCRE) pattern would work, assuming values don't have linebreaks, tabs, etc in them:
b\S[/b]
