For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.
Phase: Architecture and Design
Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
Phase: Implementation