When validating filenames, use stringent whitelists that limit the character set to be used.
If feasible, only allow a single "." character in the filename to avoid weaknesses such as
CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a whitelist
of allowable file extensions, which will help to avoid CWE-434.