I wonder if there is a more idiomatic way of doing this that web devs use that's more obviously checking it's not a path traversal? Some cool function to call?