It gets sanitized and validated through the backend.  I left this information out because we typically don't expose these limits in the documentation.  I was hoping "file name" would be sufficient.