The FilePart of MultipartFormData just uses the raw filename provided by the client. While this API is technically correct, it is very easy to mistakenly use the filename in unsafe places, such as in a path to write to a file on the system. This leaves users open to directory traversal attacks.

Instead of a filename method that returns the filename, we could perhaps have an unsafeFilename method and a sanitizedFilename method, and deprecate the existing filename method. The sanitized version could simply remove any other path components besides the actual file name, which is totally fine since the spec says the filename is only a suggested name.