This is probably better done with a string prefix match (i.e. path[0, match_string.length] == match_string) than regex.

Also, not sure when it wouldn't match since allowed_path is joined on the front.  I guess if filename has some ../ in it, but if there aren't other cases we could just check for that.